Published: 26/07/2019 Updated: 31/07/2019

CVSS v2 Base Score: 9 | Impact Score: 10 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 910

Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C

An insecure file upload and code execution issue exists in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full access to the system, as the configured user (e.g., Administrator).

Vulnerable Product	Search on Vulmon	Subscribe to Product
ahsay cloud backup suite

# Exploit Title: Authenticated insecure file upload and code execution flaw in Ahsay Backup v7x - v81150 (POC) # Date: 26-6-2019 # Exploit Author: Wietse Boonstra # Vendor Homepage: ahsaycom # Software Link: ahsay-dnahsaycom/v8/81150/cbs-winexe # Version: 7x < 81150 # Tested on: Windows / Linux # CVE : CVE-2019-10267 ...

# Exploit Title: Authenticated insecure file upload and code execution flaw in Ahsay Backup v7x - v81150 (Metasploit) # Date: 26-6-2019 # Exploit Author: Wietse Boonstra # Vendor Homepage: ahsaycom # Software Link: ahsay-dnahsaycom/v8/81150/cbs-winexe # Version: 7x < 81150 (REQUIRED) # Tested on: Windows / Linux # CVE ...

This Metasploit module exploits an authenticated insecure file upload and code execution flaw in Ahsay Backup versions 7x through 81150 To successfully execute the upload credentials are needed, default on Ahsay Backup trial accounts are enabled so an account can be created It can be exploited in Windows and Linux environments to get remote c ...

Ahsay Backup versions 7x through 81150 suffer from authenticated arbitrary file upload and remote code execution vulnerabilities ...

CWE-434 https://www.wbsec.nl/ahsay/http://packetstormsecurity.com/files/153770/Ahsay-Backup-7.x-8.x-File-Upload-Remote-Code-Execution.html http://packetstormsecurity.com/files/153771/Ahsay-Backup-7.x-8.x-File-Upload-Remote-Code-Execution.html https://nvd.nist.gov https://www.exploit-db.com/exploits/47179

CVE-2019-10267

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect