Skip to content

Commit b58550f

Browse files
committed
Indent description and fix title
1 parent da752b0 commit b58550f

File tree

1 file changed

+19
-19
lines changed

1 file changed

+19
-19
lines changed

modules/exploits/multi/http/manageengine_dc_pmp_sqli.rb

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -15,26 +15,26 @@ class Metasploit3 < Msf::Exploit::Remote
1515

1616
def initialize(info={})
1717
super(update_info(info,
18-
'Name' => "ManageEngine Password Manager Pro v6-v7 b7002 / Desktop Central v7-v9 b90033 SQL Injection",
18+
'Name' => "ManageEngine Password Manager MetadataServlet.dat SQL Injection",
1919
'Description' => %q{
20-
This module exploits an unauthenticated blind SQL injection in LinkViewFetchServlet,
21-
which is exposed in ManageEngine Desktop Central v7 build 70200 to v9 build 90033 and
22-
Password Manager Pro v6 build 6500 to v7 build 7002 (including the MSP versions). The
23-
SQL injection can be used to achieve remote code execution as SYSTEM in Windows or as
24-
the user in Linux. This module exploits both PostgreSQL (newer builds) and MySQL (older
25-
or upgraded builds). MySQL targets are more reliable due to the use of relative paths;
26-
with PostgreSQL you should find the web root path via other means and specify it with
27-
WEB_ROOT.
28-
29-
The injection is only exploitable via a GET request, which means that the payload
30-
has to be sent in chunks smaller than 8000 characters (URL size limitation). Small
31-
payloads and the use of exe-small is recommended, as you can only do between 10 and
32-
20 injections before using up all the available ManagedConnections until the next
33-
server restart.
34-
35-
This vulnerability exists in all versions released since 2006, however builds below
36-
DC v7 70200 and PMP v6 6500 do not ship with a JSP compiler. You can still try your
37-
luck using the MySQL targets as a JDK might be installed in the $PATH.
20+
This module exploits an unauthenticated blind SQL injection in LinkViewFetchServlet,
21+
which is exposed in ManageEngine Desktop Central v7 build 70200 to v9 build 90033 and
22+
Password Manager Pro v6 build 6500 to v7 build 7002 (including the MSP versions). The
23+
SQL injection can be used to achieve remote code execution as SYSTEM in Windows or as
24+
the user in Linux. This module exploits both PostgreSQL (newer builds) and MySQL (older
25+
or upgraded builds). MySQL targets are more reliable due to the use of relative paths;
26+
with PostgreSQL you should find the web root path via other means and specify it with
27+
WEB_ROOT.
28+
29+
The injection is only exploitable via a GET request, which means that the payload
30+
has to be sent in chunks smaller than 8000 characters (URL size limitation). Small
31+
payloads and the use of exe-small is recommended, as you can only do between 10 and
32+
20 injections before using up all the available ManagedConnections until the next
33+
server restart.
34+
35+
This vulnerability exists in all versions released since 2006, however builds below
36+
DC v7 70200 and PMP v6 6500 do not ship with a JSP compiler. You can still try your
37+
luck using the MySQL targets as a JDK might be installed in the $PATH.
3838
},
3939
'License' => MSF_LICENSE,
4040
'Author' =>

0 commit comments

Comments
 (0)