Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2013-7390

CWE-434 — Unrestricted File Upload6 documents4 sources
Severity
9.8CRITICAL
EPSS
66.8%
top 1.45%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Zohocorp Manageengine Desktop Central
Timeline
PublishedJan 27
Latest updateMay 5

Description

Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to execute arbitrary code by uploading a file with a jsp extension, then accessing it via a direct request to the file in the webroot.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-2jw2-8v9p-h7mp: Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7↗2022-05-05
▶
CVEList
CVE-2013-7390: Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7↗2020-01-27
▶

💥Exploits & PoCs

3
Exploit-DB
ManageEngine Desktop Central - Arbitrary File Upload / Remote Code Execution↗2014-09-01
▶
Exploit-DB
DesktopCentral AgentLogUpload - Arbitrary File Upload (Metasploit)↗2013-11-25
▶
Exploit-DB
ManageEngine Desktop Central 8.0.0 build < 80293 - Arbitrary File Upload↗2013-11-18
▶
CVE-2013-7390 (CRITICAL CVSS 9.8) | Unrestricted file upload vulnerabil | cvebase.io