CVE-2014-7866
ZOHO ManageEngine OpManager 8-11.4 Path Traversal & Arbitrary File Write via Servlets
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2014-7866.
AI-analyzed exploit summary This is a detailed technical writeup describing multiple vulnerabilities in ManageEngine products, including CVE-2014-7866, which involves remote code execution via file upload. The document provides specific endpoints, payload formats, and affected versions, demonstrating a deep understanding of the vulnerabilities.
Description
Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. (dot dot) in the (1) fileName parameter to the MigrateLEEData servlet or (2) zipFileName parameter in a downloadFileFromProbe operation to the MigrateCentralData servlet.
Exploits (2)
This is a detailed technical writeup describing multiple vulnerabilities in ManageEngine products, including CVE-2014-7866, which involves remote code execution via file upload. The document provides specific endpoints, payload formats, and affected versions, demonstrating a deep understanding of the vulnerabilities.
This is a detailed technical writeup describing multiple vulnerabilities in ManageEngine OpManager, Social IT Plus, and IT360, including remote code execution via file upload (CVE-2014-7866) and blind SQL injection (CVE-2014-7868). It provides specific exploit paths, affected versions, and mitigation steps.