Mako Server 2.5 Command Injection
Posted by deepcore on November 9, 2017 – 7:15 pm
This Metasploit module exploits a vulnerability found in Mako Server version 2.5. It’s possible to inject arbitrary OS commands in the Mako Server tutorial page through a PUT request to save.lsp. Attacker input will be saved on the victims machine and can be executed by sending a GET request to manage.lsp.
Post a reply
You must be logged in to post a comment.