ManageEngine ServiceDesk Plus Remote Code Execution
Posted by deepcore on December 29, 2021 – 7:26 am
This Metasploit module exploits CVE-2021-44077, an unauthenticated remote code execution vulnerability in ManageEngine ServiceDesk Plus, to upload an EXE (msiexec.exe) and execute it as the SYSTEM account. Note that build 11305 is vulnerable to the authentication bypass but not the file upload. The module will check for an exploitable build.
Post a reply
You must be logged in to post a comment.