CVE-2016-1593

This Metasploit module exploits an authenticated arbitrary file upload vulnerability via directory traversal in Novell ServiceDesk, allowing remote code execution on versions 6.5 to 7.1.0. It supports both Linux and Windows targets by uploading a malicious JSP payload.

This is a detailed writeup describing multiple vulnerabilities in Novell Service Desk, including arbitrary file upload (CVE-2016-1593), information disclosure (CVE-2016-1594), HQL injection (CVE-2016-1595), and stored XSS (CVE-2016-1596). It includes technical details, affected versions, and proof-of-concept examples for each vulnerability.

This Metasploit module exploits an authenticated arbitrary file upload vulnerability in Novell ServiceDesk via directory traversal, allowing remote code execution on Windows and Linux installations. It uploads a malicious JSP file containing a base64-encoded payload to achieve execution.