New DELMIA bugs disclosed after another was exploited in early Sep
"Both findings chain together: the unauth account creation gives an attacker credentials, and those credentials are then used to authenticate and abuse the file upload to drop a web shell."
Remote Code Execution in DELMIA Apriso — ProjectDiscovery Blog
Introduction DELMIA Apriso is a manufacturing execution and operations orchestration platform used by large manufacturers, service providers, and critical infrastructure operators. Because the product exposes multiple integration points (SOAP, file uploads, provisioning feeds) that are often reachable from internal networks, we performed a focused black-box assessment to surface integration and surface-area weaknesses. Our testing uncovered two chained, high-impact issues: an unauthenticated S
ProjectDiscovery (projectdiscovery.io)
