CVE-2016-7547

Related Files

Trend Micro Threat Discovery Appliance 2.6.1062r1 dlp_policy_upload.cgi Information Disclosure

Posted Apr 20, 2017

Authored by Roberto Suggi Liverani, mr_me

Trend Micro Threat Discovery Appliance versions 2.6.1062r1 and below suffer from a dlp_policy_upload.cgi information disclosure vulnerability.

tags | exploit, cgi, info disclosure

advisories | CVE-2016-7547

SHA-256 | 2b95ab05b45548336e8b0ff756872ed3b5e7c96533959277415f4b7a3ac66de3

Download | Favorite | View

Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Execution

Posted Apr 19, 2017

Authored by Roberto Suggi Liverani, mr_me | Site metasploit.com

This Metasploit module exploits two vulnerabilities the Trend Micro Threat Discovery Appliance. The first is an authentication bypass vulnerability via a file delete in logoff.cgi which resets the admin password back to 'admin' upon a reboot (CVE-2016-7552). The second is a cmd injection flaw using the timezone parameter in the admin_sys_time.cgi interface (CVE-2016-7547).

tags | exploit, cgi, vulnerability, bypass

advisories | CVE-2016-7547, CVE-2016-7552

SHA-256 | 035399021ac947492b961a04ac25a5a12f67bebc47e9858ba91b9e72dfccdc17

Download | Favorite | View