source: https://www.securityfocus.com/bid/27487/info Symantec Backup Exec System Recovery Manager is prone to a vulnerability that allows arbitrary unauthorized files to be uploaded to any location on the affected server. This issue resides in the Symantec LiveState Apache Tomcat server. Attackers can leverage it to execute arbitrary code with SYSTEM-level privileges and completely compromise affected computers. File Upload POC

Backup Exec System Recovery Manager 7.0
File Upload POC

Remote Path:
File to upload:

(c)BastardLabs 2008.