CVE-2015-4027
Acunetix Web Vulnerability Scanner < 10 - Local Privilege Escalation via AcuWVSSchedulerv10 Service
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2015-4027. PoCs published by Daniele Linguaglossa.
AI-analyzed exploit summary This exploit leverages a local privilege escalation vulnerability in Acunetix WVS 10 by injecting malicious arguments into the 'reporttemplate' parameter of the '/api/addScan' endpoint, allowing arbitrary command execution as SYSTEM.
Description
The AcuWVSSchedulerv10 service in Acunetix Web Vulnerability Scanner (WVS) before 10 build 20151125 allows local users to gain privileges via a command parameter in the reporttemplate property in a params JSON object to api/addScan.
Exploits (1)
This exploit leverages a local privilege escalation vulnerability in Acunetix WVS 10 by injecting malicious arguments into the 'reporttemplate' parameter of the '/api/addScan' endpoint, allowing arbitrary command execution as SYSTEM.