Zucchetti Ad Hoc Infinity Remote Code Execution Vulnerability

A local file inclusion vulnerability has been identified in Zucchetti Ad Hoc Infinity version 2.4, allowing authenticated attackers to execute remote code. This is achieved by uploading a JSP web/reverse shell through the application's file upload feature, which is then executed via a report generation functionality.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server, executed in the context of the web application.

Reproduction

To reproduce this vulnerability, an authenticated user must first upload a JSP shell payload using the application's file upload feature, specifying the upload directory as 'WEB-INF/Tmp'. After the file is uploaded, the user can navigate to the report generation functionality and use the 'ForwardTo' parameter to execute the uploaded shell.

Remediation

Users are advised to update to Zucchetti Ad Hoc Infinity version 4.2, where this vulnerability has been patched.