ManageEngine Application Manager Remote Code Execution
Posted by deepcore on March 30, 2018 – 3:35 am
This Metasploit module exploits a command injection vulnerability in the ManageEngine Application Manager product. An unauthenticated user can execute an operating system command under the context of privileged user. The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing the given system. This endpoint calls several internal classes and then executes powershell script without validating user supplied parameter when the given system is OfficeSharePointServer.
Post a reply
You must be logged in to post a comment.