CVE-2019-8394

This exploit demonstrates an arbitrary file upload vulnerability in Zoho ManageEngine ServiceDesk Plus before 10.0 build 10012. By setting the 'module' parameter to 'CustomLogin', the file extension check is bypassed, allowing an authenticated user to upload a malicious JSP file to the server.

This Metasploit module exploits an unauthenticated file upload vulnerability in ManageEngine ServiceDesk Plus (CVE-2019-8394) by uploading a malicious EAR file containing a WAR payload, leading to remote code execution on vulnerable versions (v9 b9000 - b9102).