### [CVE-2014-5301](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5301)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4.

### POC

#### Reference
- http://packetstormsecurity.com/files/129806/ManageEngine-Shell-Upload-Directory-Traversal.html
- http://packetstormsecurity.com/files/130020/ManageEngine-Multiple-Products-Authenticated-File-Upload.html
- http://seclists.org/fulldisclosure/2015/Jan/5
- https://www.exploit-db.com/exploits/35845/

#### Github
- https://github.com/0xMafty/Helpdesk
- https://github.com/AndyCyberSec/OSCP
- https://github.com/basicinfosecurity/exploits
- https://github.com/hktalent/bug-bounty