CVE-2016-6602
CRITICALZOHO WebNMS Framework 5.2-5.2 SP1 - Info Disclosure
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2016-6602.
PoCs published by Pedro Ribeiro, including Metasploit module auxiliary/admin/http/webnms_cred_disclosure.
AI-analyzed exploit summary The document describes multiple vulnerabilities in WebNMS Framework Server 5.2 and 5.2 SP1, including directory traversal leading to RCE, file download via traversal, weak password obfuscation, and user impersonation. CVE-2016-6603 specifically covers user account impersonation via the 'UserName' HTTP header.
Description
ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit.
Exploits (2)
The document describes multiple vulnerabilities in WebNMS Framework Server 5.2 and 5.2 SP1, including directory traversal leading to RCE, file download via traversal, weak password obfuscation, and user impersonation. CVE-2016-6603 specifically covers user account impersonation via the 'UserName' HTTP header.
This Metasploit module exploits two vulnerabilities in WebNMS Framework Server 5.2: an unauthenticated file download via the FetchFile servlet to retrieve 'conf/securitydbData.xml', and a weak obfuscation algorithm to reverse-engineer plaintext credentials. It extracts and displays usernames and passwords.
References (9)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H