ManageEngine ADAudit Plus Path Traversal / XML Injection
Posted by deepcore on August 9, 2022 – 9:06 pm
This Metasploit module exploits CVE-2022-28219, which is a pair of vulnerabilities in ManageEngine ADAudit Plus versions before build 7060. They include a path traversal in the /cewolf endpoint along with a blind XML external entity injection vulnerability to upload and execute a file.
Post a reply
You must be logged in to post a comment.