Meinberg LANTIME Web Configuration Utility 6.16.008 Arbitrary File Upload

`Title: Meinberg LANTIME Web Configuration Utility - Arbitrary File Upload  
(Path Traversal)  
Author: Jakub Palaczynski  
CVE: CVE-2017-16788  
  
  
Exploit was tested on:  
======================  
  
Meinberg LANTIME Web Configuration Utility 6.16.008  
  
  
Vulnerability affects:  
======================  
All LTOS6 firmware releases before 6.24.004  
  
  
Vulnerability:  
**************  
  
Arbitrary File Upload (Path Traversal):  
=======================================  
  
It is possible to upload any file to any location on the server.  
  
Proof of Concept:  
"Upload Groupkey" functionality allows for uploading any file to any  
location on the server. An attacker may use path traversal to store files  
in for example cron.d directory and execute them automatically to get root  
access on the system.  
This vulnerability allows for getting root access on the system from  
Admin-User access.  
  
Contact:  
========  
  
Jakub[dot]Palaczynski[at]gmail[dot]com  
  
  
`