This host is running ManageEngine DesktopCentral and is prone to arbitrary file upload vulnerability.

Successful exploitation will allow an attacker to gain arbitrary code execution on the server. Impact Level: System/Application

Apply the patch supplied by the vendor (Patch 80293), http://www.manageengine.com/products/desktop-central

The flaw in the AgentLogUploadServlet. This servlet takes input from HTTP POST and constructs an output file on the server without performing any sanitisation or even checking if the caller is authenticated.

ManageEngine DesktopCentral 8.0.0 (build 80293 and below)

Send a crafted exploit string via HTTP POST request and check whether it is able to create the file or not.

• http://security-assessment.com/files/documents/advisory/DesktopCentral%20Arbitrary%20File%20Upload.pdf
• http://www.exploit-db.com/exploits/29674

---

Updated on 2015-03-25