ManageEngine Desktop Central statusUpdate Arbitrary File Upload RCE (intrusive check)

The ManageEngine Desktop Central application running on the remote host is affected by a flaw in the statusUpdate script due to a failure to properly sanitize user-supplied input to the 'fileName' parameter. An unauthenticated, remote attacker can exploit this, via a crafted request to upload a J...

PT-2014-6245

Name of the Vulnerable Software and Affected Versions ManageEngine Desktop Central versions prior to 9 build 90055 Description The issue allows remote attackers to execute arbitrary code via a .. dot dot in the fileName parameter in an LFU action to statusUpdate. This is a directory traversal...

CVE-2014-5005: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in ZOHO ManageEngine Desktop Central DC before 9 build 90055 allows remote attackers to execute arbitrary code via a .. dot dot in the fileName parameter in an LFU action to statusUpdate...

ManageEngine Desktop Central StatusUpdate Arbitrary File Upload

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include...