CVE-2016-6600

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. (dot dot) in the fileName parameter to servlets/FileUploadServlet.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.htmlExploit, Third Party Advisory
http://seclists.org/fulldisclosure/2016/Aug/54Exploit, Mailing List
http://www.securityfocus.com/archive/1/539159/100/0/threaded
http://www.securityfocus.com/bid/92402Third Party Advisory, VDB Entry
https://blogs.securiteam.com/index.php/archives/2712Exploit, Technical Description, Third Party Advisory
https://forums.webnms.com/topic/recent-vulnerabilities-in-webnms-and-how-to-protect-the-server-against-them
https://github.com/pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txtExploit
https://www.exploit-db.com/exploits/40229/Exploit, Third Party Advisory
http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.htmlExploit, Third Party Advisory
http://seclists.org/fulldisclosure/2016/Aug/54Exploit, Mailing List
http://www.securityfocus.com/archive/1/539159/100/0/threaded
http://www.securityfocus.com/bid/92402Third Party Advisory, VDB Entry
https://blogs.securiteam.com/index.php/archives/2712Exploit, Technical Description, Third Party Advisory
https://forums.webnms.com/topic/recent-vulnerabilities-in-webnms-and-how-to-protect-the-server-against-them
https://github.com/pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txtExploit
https://www.exploit-db.com/exploits/40229/Exploit, Third Party Advisory

Timeline

Published: Jan 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-66017.5Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to rea CVE-2016-66029.8ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtai CVE-2016-66039.8ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP CVE-2016-66049.8NULL pointer dereference in Samsung Exynos fimg2d driver for Android L(5.0/5.1) and M(6.0) allows attackers to have unspecified impact via u CVE-2016-66057.5Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization.CVE-2016-66068.1An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack CVE-2016-66076.1XSS issues were discovered in phpMyAdmin. This affects Zoom search (specially crafted column content can be used to trigger an XSS attack); CVE-2016-66086.1XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially c CVE-2016-66098.8An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array expor CVE-2016-66104.3A full path disclosure vulnerability was discovered in phpMyAdmin where a user can trigger a particular error in the export mechanism to dis CVE-2016-66118.1An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through CVE-2016-66126.5An issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database