ManageEngine ADAudit Plus | CVE-2023-50438

The vulnerability discovered in ADAudit Plus allows an attacker to execute arbitrary directory traversal and create files or folders. This exploit involves manipulating the indexing path within the “search-archived-events” section. By sending a crafted POST request with modified settings, an attacker can traverse directories and create files or folders at arbitrary locations. This poses a significant risk as it could be exploited by authenticated users to execute unauthorized actions.

Discovered by Hazard Lab.