CVE-2015-6922

Related Files

Kaseya VSA Master Administrator Account Creation

Posted Aug 31, 2024

Authored by Pedro Ribeiro | Site metasploit.com

This Metasploit module abuses the setAccount page on Kaseya VSA between 7 and 9.1 to create a new Master Administrator account. Normally this page is only accessible via the localhost interface, but the application does nothing to prevent this apart from attempting to force a redirect. This Metasploit module has been tested with Kaseya VSA v7.0.0.17, v8.0.0.10 and v9.0.0.3.

tags | exploit

advisories | CVE-2015-6922

SHA-256 | e1841c8b0337c3452bf57ed8cf0802fbe917a2421419b4624898bce377235405

Download | Favorite | View

Kaseya VSA uploader.aspx Arbitrary File Upload

Posted Oct 2, 2015

Authored by Pedro Ribeiro | Site metasploit.com

This Metasploit module exploits an arbitrary file upload vulnerability found in Kaseya VSA versions between 7 and 9.1. A malicious unauthenticated user can upload an ASP file to an arbitrary directory leading to arbitrary code execution with IUSR privileges. This Metasploit module has been tested with Kaseya v7.0.0.17, v8.0.0.10 and v9.0.0.3.

tags | exploit, arbitrary, code execution, asp, file upload

advisories | CVE-2015-6922

SHA-256 | a3160e35b949105dc779c6f1769beb11f955240e314addc241694dc44304af7d

Download | Favorite | View

Kaseya Virtual System Administrator Code Execution / Privilege Escalation

Posted Sep 30, 2015

Authored by Pedro Ribeiro

Kaseya Virtual System Administrator suffers from multiple code execution vulnerabilities and a privilege escalation vulnerability. VSA versions 7.0.0.0 through 7.0.0.32, 8.0.0.0 through 8.0.0.22, 9.0.0.0 through 9.0.0.18, and 9.1.0.0 through 9.1.0.8 are affected.

tags | exploit, vulnerability, code execution

advisories | CVE-2015-6589, CVE-2015-6922

SHA-256 | 1c99f00ec0d2ed27ea5157a13205f5e690ec57a19a7df31ce5375b1b3e123c64

Download | Favorite | View