Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an addUser action to STATEID/1417736606982/roleMgmt.do...

CVE-2014-9331

CVE-2014-9331 affects ManageEngine Desktop Central. A CSRF in roleMgmt.do allows an authenticated admin to add an administrator via addUser, enabling account creation without proper validation. Affected: Desktop Central before 9 build 90130 (and related 9.x builds). Impact is hijacking admin auth...

ManageEngine Desktop Central 9 Build 90087 - Cross-Site Request Forgery

:8020/STATEID/1417736606982/roleMgmt.do?actionToCall=addUser&SUBREQUEST=XMLHTTP" method="POST" input type="hidden" name="newADAuthUserEmail...

ManageEngine Desktop Central 9 Build 90087 - CSRF Vulnerability

Exploit for jsp platform in category web applications :8020/STATEID/1417736606982/roleMgmt.do?actionToCall=addUser&SUBREQUEST=XMLHTTP" method="POST" input type="hidden" name="newDCAu...

ManageEngine Desktop Central 9 Build 90087 - Cross-Site Request Forgery

ManageEngine Desktop Central 9 Build 90087 - Cross-Site Request Forgery :8020/STATEID/1417736606982/roleMgmt.do?actionToCall=addUser&SUBREQUEST=XMLHTTP" method="POST" input type="hidden" name="newDCAuthUser...

ManageEngine Desktop Central - Create Administrator

ManageEngine Desktop Central - Create Administrator Administrator account creation in ManageEngine Desktop Central / Desktop Central MSP Discovered by Pedro Ribeiro [email protected], Agile Information Security =================================================================================...

ManageEngine Desktop Central - Create Administrator

Administrator account creation in ManageEngine Desktop Central / Desktop Central MSP Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= Disclosure: 31/12/2014 / Last updated: 05/01/2015...

ManageEngine Desktop Central MSP StatusUpdateServlet fileName File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. The specific flaw exists within the StatusUpdateServlet servlet. The issue lies in the failure to...

ManageEngine Desktop Central Administrator Account Creation

This module exploits an administrator account creation vulnerability in Desktop Central from v7 onwards by sending a crafted request to DCPluginServelet. It has been tested in several versions of Desktop Central including MSP from v7 onwards. This module requires Metasploit:...

ManageEngine Desktop Central Remote Security Bypass Vulnerability

Manageengine desktop central is a complete windows client management software that enables remote management of desktop and mobile computers with its remote software installation and configuration options. A remote security bypass vulnerability exists in ManageEngine Desktop Central, which can be...

Desktop Central Add Administrator

Hi, This is part 10 of the ManageOwnage series. For previous parts, see 1. This time we have a vulnerability that allows an unauthenticated user to create an administrator account, which can then be used to execute code on all devices managed by Desktop Central desktops, servers, mobile devices,...

Code injection

The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON object...

CVE-2014-9371

The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON object...

CVE-2014-9371

The affected software is ManageEngine Desktop Central MSP (on-premises). Affected component: NativeAppServlet, vulnerable to remote code execution through crafted JSON data. Root cause: failure to sanitize JSON input before processing, enabling arbitrary code execution with SYSTEM context. The vu...

ManageEngine Desktop Central MSP Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NativeAppServlet servlet. The issue lies in the failure to saniti...

ManageEngine Desktop Central StatusUpdate Arbitrary File Upload

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include...

Multiple ManageEngine Products 7.0 - 9.0.054 Arbitrary File Upload Vulnerability

Multiple ManageEngine Products are prone to an arbitrary-file-upload vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ManageEngine Desktop Central - Arbitrary File Upload / RCE

No description provided by source. Arbitrary file upload / remote code execution in ManageEngine Desktop Central / Desktop Central MSP Discovered by Pedro Ribeiro [email protected], Agile Information Security =================================================================================...

ManageEngine Desktop Central - Arbitrary File Upload / Remote Code Execution

Arbitrary file upload / remote code execution in ManageEngine Desktop Central / Desktop Central MSP Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= Background on the affected product: "Deskt...

ManageEngine Desktop Central - Arbitrary File Upload Remote Code Execution

ManageEngine Desktop Central - Arbitrary File Upload Remote Code Execution Arbitrary file upload / remote code execution in ManageEngine Desktop Central / Desktop Central MSP Discovered by Pedro Ribeiro [email protected], Agile Information Security...