Multiple ManageEngine Products CVE-2014-5005 Arbitrary File Upload Vulnerability

Bugtraq ID:	69494
Class:	Input Validation Error
CVE:	CVE-2014-5005
Remote:	Yes
Local:	No
Published:	Aug 31 2014 12:00AM
Updated:	Sep 10 2014 12:16AM
Credit:	Pedro Ribeiro
Vulnerable:
Not Vulnerable:

Multiple ManageEngine Products CVE-2014-5005 Arbitrary File Upload Vulnerability

Multiple ManageEngine Products are prone to an arbitrary-file-upload vulnerability.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.

The following products are vulnerable:

ManageEngine DesktopCentral versions 7 through 9 build 90054
ManageEngine DesktopCentral MSP

Multiple ManageEngine Products CVE-2014-5005 Arbitrary File Upload Vulnerability

Attackers can exploit this issue through a browser.

The following example data and an exploit code is available:

POST /statusUpdate?actionToCall=LFU&customerId=1337&fileName=../../../../../../shell.jsp&configDataID=1<...jsp shell here ...>

• /data/vulnerabilities/exploits/69494.py

Multiple ManageEngine Products CVE-2014-5005 Arbitrary File Upload Vulnerability

Solution:
Reportedly, the issue is fixed; however, Symantec has not confirmed this. Please contact the vendor for more information.

Multiple ManageEngine Products CVE-2014-5005 Arbitrary File Upload Vulnerability

References: