ManageEngine Applications Manager Build 12700 - Multiple Vulnerabilities

ID EDB-ID:39780
Type exploitdb
Reporter Saif El-Sherei
Modified 2016-05-06T00:00:00


ManageEngine Applications Manager Build 12700 - Multiple Vulnerabilities. Webapps exploit for jsp platform

                                            [SPSA-2016-02/ManageEngine ApplicationsManager]------------------------------

SECURITY ADVISORY:   SPSA-2016-02/ManageEngine Applications Manager Build No: 12700

Affected Software:   ManageEngine Applications Manager Build No: 12700
Vulnerability:       Information Disclosure and Un-Authenticated SQL
CVSSv3:              9.3
Severity:            Critical
Release Date:        2016-05-05

I. Background

ManageEngine Applications Manager is an Application Performance Monitoring across physical, virtual and cloud environments.

II. Description

For details about the fix please visit

Information Disclosure:

Some scripts were accessible without authentication, which allowed public access to sensitive data such as licensing information and Monitored Server Details like name IP and maintenance schedule.


License Information:

List of Maintenance tasks:

Details of Maintenance tasks with details about monitored server:

SQL Injection:

The script is vulnerable to a Boolean based blind, and Union based SQL injection, that allows complete unauthorized access to the back-end database, according to the level of privileges of the application database user.

Vulnerable URL:
Vulnerable Parameter: GET parameter taskid


Boolean Based Blind SQL Injection PoC: 

and 1=1  (True)

and 1=2  (False)

The following will include the Database Name in the Schedule Details
Description text box:

Union-Based SQL Injection PoC: Number of Columns 15, ORDER BY was

MSSQL: During our testing, the payload needed to be URL Encoded.


MYSQL: During our testing, the payload did not need URL Encoding.


III. Impact

Information Disclosure Impact:

An attacker might make use of the intelligence gathered through information leakages such as these for further attacks against the application, and its underlying infrastructure

Un-Authenticated SQL Injection Impact:

Access to sensitive information, stored in the application Database server, depending on the privileges of the application's database user. 

IV. Remediation

Apply Vendor supplied patch build #12710, details are available at

V. Disclosure

Reported By: Saif El-Sherei, @saif_sherei,

Discovery Date:         2016-02-29
Vendor Informed:        2016-03-04
Advisory Release Date:  2016-05-05
Patch Release Date:     2016-04-28
Advisory Updated:    	2016-05-05

---------------------------------[SPSA-2016-02/ManageEngine ApplicationsManager]---