rapid7/metasploit-framework — pull request #988 by wchen-r7 (2012-10-29 17:27:17+00:00)
Title: Add OSVDB-86563 ManageEngine SecurityManager Plus Dir Traversal

This module exploits a directory traversal flaw found in ManageEngine SecurityManager Plus 5.5 or less. When handling a file download request, the DownloadServlet class fails to properly check the 'f' parameter, which can be abused to read any file outside the virtual directory.

This pull request also renames the old Device Expert module to something more specific to avoid confusion, because we have multiple ManageEngine modules in the same dir.