@@ -19,15 +19,15 @@ def initialize
19
19
'Description' => %q{
20
20
This module exploits an arbitrary file upload vulnerability on HP Managed Printing
21
21
Administration 2.6.3 (and before). The vulnerability exists in the UploadFiles()
22
- function from the MPAUploader.Uploader.1 control, loaded and used on server side .
22
+ function from the MPAUploader.Uploader.1 control, loaded and used by the server .
23
23
The function can be abused via directory traversal and null byte injection in order
24
- to achieve arbitrary file upload. In order to upload successfully the file cannot
25
- exist in the filesystem. On the other hand, files are written with the privileges of
26
- the Internet Guest Account (IUSR_*). The module tries to achieve code execution by
27
- uploading ASP code into the webroot folder, on locations where server side code is
28
- allowed. By default the /hpmpa/userfiles/ and subfolders are used, since IUSR_*
29
- write privileges are needed for some application functions. The user can specify an
30
- arbitrary location through the WEBFOLDER option .
24
+ to achieve arbitrary file upload. In order to exploit successfully, a few conditions
25
+ must be met: 1) A writable location under the context of Internet Guest Account
26
+ (IUSR_*), or Everyone is required. By default, this module will attempt to write to
27
+ /hpmpa/userfiles/, but you may specify the WRITEWEBFOLDER datastore option to provide
28
+ another writable path. 2) The writable path must also be readable by a browser,
29
+ this typically means a location under wwwroot. 3) You cannot overwrite a file with
30
+ the same name as the payload .
31
31
} ,
32
32
'Author' => [
33
33
'Andrea Micalizzi' , # aka rgod - Vulnerability Discovery
0 commit comments