CVE-2015-8249

This Metasploit module exploits a file upload vulnerability in ManageEngine Desktop Central 9 by injecting a null byte to bypass file extension checks, allowing arbitrary JSP file upload and execution for remote code execution.

This Metasploit module exploits a path traversal vulnerability in ManageEngine Desktop Central 9's FileUploadServlet to upload a malicious JSP file, achieving remote code execution as SYSTEM. The exploit leverages a null byte injection in the ConnectionId parameter to bypass file extension checks and place the payload in a web-accessible directory.