CVE-2010-5324
Novell ZENworks Configuration Management (ZCM) <10.3 - Path Traversal
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2010-5324.
PoCs published by Metasploit, MC, including Metasploit module exploits/windows/http/zenworks_uploadservlet.
AI-analyzed exploit summary This Metasploit module exploits a directory traversal vulnerability in Novell ZENworks Configuration Management 10.2.0 via the UploadServlet to upload a malicious WAR file outside the intended directory, leading to remote code execution.
Description
Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 before 10.3 allows remote attackers to execute arbitrary code via a zenworks-fileupload request with a crafted directory name in the type parameter, in conjunction with a WAR filename in the filename parameter and WAR content in the POST data, a different vulnerability than CVE-2010-5323.
Exploits (2)
This Metasploit module exploits a directory traversal vulnerability in Novell ZENworks Configuration Management 10.2.0 via the UploadServlet to upload a malicious WAR file outside the intended directory, leading to remote code execution.
This Metasploit module exploits a directory traversal vulnerability in Novell ZENworks Configuration Management 10.2.0 to upload a malicious WAR file outside the intended directory, leading to arbitrary code execution via a JSP payload.