rapid7/metasploit-framework — pull request #3965 by pedrib (2014-10-07 22:53:07+00:00)
Title: Add exploit for CVE-2014-4872 / file upload

This module is an exploit for CVE-2014-4872 / CERT VU 121036. BMC Track-It! exposes an unauthenticated .NET remoting service that allows upload of a file to an arbitrary location. This can be abused to achieve remote code execution by writing an ASP or ASPX to the web root.
It has been very well tested on all vulnerable versions of Track-It! - version 9 to the latest 11.3.

This is a 0 day exploit as BMC have not responded to CERT and they went ahead with the disclosure. A companion pull request for a module that extracts the domain credentials and SQL database creds will be made soon.