Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.