Exploitation Summary
EIP tracks 2 public exploits for CVE-2016-0854.
PoCs published by Metasploit, rgod, including Metasploit module exploits/windows/scada/advantech_webaccess_dashboard_file_upload.
AI-analyzed exploit summary This Metasploit module exploits an arbitrary file upload vulnerability in Advantech WebAccess 8.0, allowing unauthenticated remote code execution via a malicious ASPX file upload.
Description
Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors.
Exploits (2)
This Metasploit module exploits an arbitrary file upload vulnerability in Advantech WebAccess 8.0, allowing unauthenticated remote code execution via a malicious ASPX file upload.
This Metasploit module exploits an arbitrary file upload vulnerability in Advantech WebAccess 8.0, allowing unauthenticated attackers to upload and execute malicious ASPX files on the server. The exploit leverages insufficient validation in the uploadImageCommon function to achieve remote code execution.
References (6)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H