module

Idera Up.Time Monitoring Station 7.0 post2file.php Arbitrary File Upload

Try Surface Command
Back to search
Disclosed
2013-11-19
Created
2018-05-30

Description

This module exploits an arbitrary file upload vulnerability found within the Up.Time
monitoring server 7.2 and below. A malicious entity can upload a PHP file into the
webroot without authentication, leading to arbitrary code execution.

Although the vendor fixed Up.Time to prevent this vulnerability, it was not properly
mitigated. To exploit against a newer version of Up.Time (such as 7.4), please use
exploits/multi/http/uptime_file_upload_2.

Author

Denis Andzakovic denis.andzakovic@security-assessment.com

Platform

PHP

Architectures

php

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/multi/http/uptime_file_upload_1
    msf exploit(uptime_file_upload_1) > show targets
        ...targets...
    msf exploit(uptime_file_upload_1) > set TARGET < target-id >
    msf exploit(uptime_file_upload_1) > show options
        ...show and set options...
    msf exploit(uptime_file_upload_1) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today