CVE-2013-7091

Related Files

Zimbra Collaboration Server LFI

Posted Dec 23, 2013

Authored by rubina119 | Site metasploit.com

This Metasploit module exploits a local file inclusion on Zimbra 8.0.2 and 7.2.2. The vulnerability allows an attacker to get the LDAP credentials from the localconfig.xml file. The stolen credentials allow the attacker to make requests to the service/admin/soap API. This can then be used to create an authentication token for the admin web interface. This access can be used to achieve remote code execution. This Metasploit module has been tested on Zimbra Collaboration Server 8.0.2 with Ubuntu Server 12.04.

tags | exploit, remote, web, local, code execution, file inclusion

systems | linux, ubuntu

advisories | CVE-2013-7091

SHA-256 | e41cf490ab9469ce31ade3e3bc8198d90c941e76e3bd760f92078a0dc9e99472

Download | Favorite | View