critical9.8Public exploit code
CVE-2014-5007
Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP)…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- DesktopCentral AgentLogUpload - Arbitrary File Upload (Metasploit)2013-11-25 · remote · windows · Verified
- ManageEngine Desktop Central - Arbitrary File Upload / Remote Code Execution2014-09-01 · webapps · jsp
- ManageEngine Desktop Central 8.0.0 build < 80293 - Arbitrary File Upload2013-11-18 · webapps · jsp
Impact
Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90055 allows remote attackers to write to and execute arbitrary files as SYSTEM via a .. (dot dot) in the filename parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zohocorp | Manageengine Desktop Central | from 7.0 through 9.0 |
| Zohocorp | Manageengine Desktop Central Managed Service Providers | from 7.0 through 9.0 |