Listen to this Post
How the CVE Works
This vulnerability is an unauthenticated file upload flaw in the Metrics component of HCL Unica. The affected endpoint does not properly validate user-supplied file names or content. An attacker can craft a malicious HTTP POST request containing a file payload, such as a webshell (e.g., a JSP file). By uploading this file to a predictable or discoverable location on the server’s web root, the attacker achieves remote code execution. The server executes the uploaded script with the same privileges as the Unica application, typically high-level system access, allowing full control over the compromised host.
DailyCVE Form
Platform: HCL Unica
Version: 12.0.0
Vulnerability: Unauthenticated File Upload
Severity: Critical
Date: 11/28/2025
Prediction: Patch by 02/15/2026
What Undercode Say
curl -X POST -F "[email protected]" http://target:port/unica/metrics/upload find / -name ".jsp" -path "unica" 2>/dev/null echo "Malicious JSP Content" > /tmp/webshell.jsp
How Exploit
1. Discover vulnerable `/metrics/upload` endpoint.
2. Craft POST request with webshell.
3. Upload file to web-accessible directory.
4. Access uploaded file to trigger execution.
Protection from this CVE
1. Apply vendor patch.
2. Implement strong file validation.
3. Use web application firewall (WAF).
4. Restrict upload directory permissions.
Impact
Remote Code Execution (RCE)
Full System Compromise
Data Breach Potential
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
