@@ -15,26 +15,26 @@ class Metasploit3 < Msf::Exploit::Remote
15
15
16
16
def initialize ( info = { } )
17
17
super ( update_info ( info ,
18
- 'Name' => "ManageEngine Password Manager Pro v6-v7 b7002 / Desktop Central v7-v9 b90033 SQL Injection" ,
18
+ 'Name' => "ManageEngine Password Manager MetadataServlet.dat SQL Injection" ,
19
19
'Description' => %q{
20
- This module exploits an unauthenticated blind SQL injection in LinkViewFetchServlet,
21
- which is exposed in ManageEngine Desktop Central v7 build 70200 to v9 build 90033 and
22
- Password Manager Pro v6 build 6500 to v7 build 7002 (including the MSP versions). The
23
- SQL injection can be used to achieve remote code execution as SYSTEM in Windows or as
24
- the user in Linux. This module exploits both PostgreSQL (newer builds) and MySQL (older
25
- or upgraded builds). MySQL targets are more reliable due to the use of relative paths;
26
- with PostgreSQL you should find the web root path via other means and specify it with
27
- WEB_ROOT.
28
-
29
- The injection is only exploitable via a GET request, which means that the payload
30
- has to be sent in chunks smaller than 8000 characters (URL size limitation). Small
31
- payloads and the use of exe-small is recommended, as you can only do between 10 and
32
- 20 injections before using up all the available ManagedConnections until the next
33
- server restart.
34
-
35
- This vulnerability exists in all versions released since 2006, however builds below
36
- DC v7 70200 and PMP v6 6500 do not ship with a JSP compiler. You can still try your
37
- luck using the MySQL targets as a JDK might be installed in the $PATH.
20
+ This module exploits an unauthenticated blind SQL injection in LinkViewFetchServlet,
21
+ which is exposed in ManageEngine Desktop Central v7 build 70200 to v9 build 90033 and
22
+ Password Manager Pro v6 build 6500 to v7 build 7002 (including the MSP versions). The
23
+ SQL injection can be used to achieve remote code execution as SYSTEM in Windows or as
24
+ the user in Linux. This module exploits both PostgreSQL (newer builds) and MySQL (older
25
+ or upgraded builds). MySQL targets are more reliable due to the use of relative paths;
26
+ with PostgreSQL you should find the web root path via other means and specify it with
27
+ WEB_ROOT.
28
+
29
+ The injection is only exploitable via a GET request, which means that the payload
30
+ has to be sent in chunks smaller than 8000 characters (URL size limitation). Small
31
+ payloads and the use of exe-small is recommended, as you can only do between 10 and
32
+ 20 injections before using up all the available ManagedConnections until the next
33
+ server restart.
34
+
35
+ This vulnerability exists in all versions released since 2006, however builds below
36
+ DC v7 70200 and PMP v6 6500 do not ship with a JSP compiler. You can still try your
37
+ luck using the MySQL targets as a JDK might be installed in the $PATH.
38
38
} ,
39
39
'License' => MSF_LICENSE ,
40
40
'Author' =>
0 commit comments