ManageEngine DeviceExpert 'FileName' Parameter Directory Traversal Vulnerability

Bugtraq ID:	52559
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 19 2012 12:00AM
Updated:	Mar 19 2012 12:00AM
Credit:	rgod
Vulnerable:	ZOHO Corporation ManageEngine DeviceExpert 5.6
Not Vulnerable:

ManageEngine DeviceExpert 'FileName' Parameter Directory Traversal Vulnerability

ManageEngine DeviceExpert is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks.

ManageEngine DeviceExpert 5.6 is vulnerable; other versions may also be affected.

ManageEngine DeviceExpert 'FileName' Parameter Directory Traversal Vulnerability

An attacker can exploit the issue through a browser

The following example URIs and exploit code are available:

http://wwww.example.com/6060/scheduleresult.de/?FileName=conf\Authentication\auth-conf.xml
http://wwww.example.com/6060/scheduleresult.de/?FileName=..\..\..\..\..\..\..\..\..\..\boot.ini

• /data/vulnerabilities/exploits/52559.php

ManageEngine DeviceExpert 'FileName' Parameter Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

ManageEngine DeviceExpert 'FileName' Parameter Directory Traversal Vulnerability

References:

• ManageEngine DeviceExpert Homepage (Zoho Corporation)
  
• ManageEngine DeviceExpert 5.6 Java Server ScheduleResultViewer servlet Unauthen ([email protected])