exploit the possibilities

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Kentico CMS 12.0.14 Remote Command Execution

Posted May 6, 2020

Authored by aushack, Manoj Cherukuri, Justin LeMay | Site metasploit.com

This Metasploit module exploits a vulnerability in the Kentico CMS platform versions 12.0.14 and earlier. Remote command execution is possible via unauthenticated XML requests to the Staging Service SyncServer.asmx interface ProcessSynchronizationTaskData method stagingTaskData parameter. XML input is passed to an insecure .NET deserialize call which allows for remote command execution.

tags | exploit, remote

advisories | CVE-2019-10068

SHA-256 | 5b68d0d542ef6100308fe77d235af8615fef5ce550885eedaeb120ad41bc9f6f

Download | Favorite | View

Related Files

No related files