CVE-2013-7390

CRITICAL

ManageEngine DesktopCentral <8.0.0 - RCE

Title source: llm

Description

Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to execute arbitrary code by uploading a file with a jsp extension, then accessing it via a direct request to the file in the webroot.

Exploits (4)

metasploit WORKING POC EXCELLENT

rubypocwin

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/desktopcentral_file_upload.rb

View Code ZIP pw:eip

exploitdb WORKING POC

webappsjsp

https://www.exploit-db.com/exploits/29674

View on exploitdb

exploitdb WRITEUP

webappsjsp

https://www.exploit-db.com/exploits/34518

View on exploitdb

exploitdb WORKING POC

rubyremotewindows

https://www.exploit-db.com/exploits/29812

View on exploitdb

References (2)

[Exploit, Mailing List, Third Party Advisory] http://seclists.org/fulldisclosure/2013/Nov/130

[Exploit, Third Party Advisory] https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/desktopcentral_file_upload.rb

Scores

CVSS v3 9.8

EPSS 0.6678

EPSS Percentile 98.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-434

Status published

Affected Products (1)

zohocorp/manageengine_desktop_central < 8.0.0

Timeline

Published Jan 27, 2020

Tracked Since Feb 18, 2026