CVE-2012-1195

EPSS 68.4%

Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via a PutUpdateFileCore command in a RunAMTCommand SOAP request, then accessing the file via a direct request to the file in the web root.

Affected products

n/a · n/a

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/18714unverified exploitdbwww.exploit-db.com/exploits/18622unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://osvdb.org/79276 http://secunia.com/advisories/47666 https://exchange.xforce.ibmcloud.com/vulnerabilities/73207 http://www.securityfocus.com/bid/52023 http://www.securitytracker.com/id?1026693