CVE-2014-5005

Related Files

ManageEngine Desktop Central StatusUpdate Arbitrary File Upload

Posted Sep 8, 2014

Authored by Pedro Ribeiro | Site metasploit.com

This Metasploit module exploits an arbitrary file upload vulnerability in ManageEngine DesktopCentral v7 to v9 build 90054 (including the MSP versions). A malicious user can upload a JSP file into the web root without authentication, leading to arbitrary code execution as SYSTEM. Some early builds of version 7 are not exploitable as they do not ship with a bundled Java compiler.

tags | exploit, java, web, arbitrary, root, code execution, file upload

advisories | CVE-2014-5005

SHA-256 | 3f00913148c06a584d92ce2a97c94e9b52e8665ae0cc5ea1934eb1b11d43053a

Download | Favorite | View

ManageEngine Desktop Central Remote Shell Upload

Posted Aug 31, 2014

Authored by Pedro Ribeiro

ManageEngine Desktop Central suffers from code execution and remote shell upload vulnerabilities.

tags | exploit, remote, shell, vulnerability, code execution

advisories | CVE-2014-5005, CVE-2014-5006, CVE-2014-5007

SHA-256 | 10bd111ea2eac7377ab0c21dde2c9553725d2797491800a418dea4169e3ccb4a

Download | Favorite | View