Sql injection

2019-04-2211:29:00

PRIOn knowledge base

www.prio-n.com

9.8 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

79.7%

JSON

An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a Popup_SLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file.

CPENameOperatorVersion
manageengine_applications_managerge11.0
manageengine_applications_managerle14.0

CPE	Name	Operator	Version
	manageengine_applications_manager	ge	11.0
	manageengine_applications_manager	le	14.0

References

pentest.com.tr/exploits/ManageEngine-App-Manager-14-SQLi-Remote-Code-Execution.html

www.exploit-db.com/exploits/46725

www.exploit-db.com/exploits/46725/

www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-11448.html