CVE-2019-12189

CVE-2019-12189 - Zoho ManageEngine ServiceDesk Plus 9.3 XSS vulnerability Information Description:XSS was discovered in ManageEngine ServiceDesk Plus version Versions Affected: 9.3 Researcher: Dang The Tuyen Proof-of-concept The vulnerability stems from the confusion of both single quotes and...

CVE-2022-47966

CVE-2022-47966 POC for CVE-2022-47966 affecting the following ManageEngine products: Access Manager Plus Active Directory 360 ADAudit Plus ADManager Plus ADSelfService Plus Analytics Plus Application Control Plus Asset Explorer Browser Security Plus Device Control Plus Endpoint Central Endpoint...

Golang-CVE-2021-44077-POC

Golang-CVE-2021-44077-POC This exploit is an unauthenticated RCE in Zoho ManageEngine ServiceDesk Plus msiexec.exe Then, run the exploit. go run CVE-2021-44077.go -u "http://192.168.1.3:8080/" -f "/msiexec.exe" -u is the vulnerable URL -f is your malicious file...

CVE-2021-31159

Zoho ManageEngine ServiceDesk Plus MSP - Active Directory User Enumeration CVE-2021-31159 This script takes advantage of ServiceDesk Plus before build 10519 having different output in the password recovery functionality: if the user exists it returns a message claiming an email has been sent but ...

CVE-2021-44077

CVE-2021-44077 Proof of Concept Exploit for CVE-2021-44077: PreAuth RCE in ManageEngine ServiceDesk Plus msiexec.exe pip install the requirements file or make sure you've got the requests package. If you're trying to catch a reverse shell, run your listener first, e.g. nc -l 4444 Then run the...

CVE-2020-35682

CVE-2020-35682 SD-91948: CVE-2020-35682: Authentication Bypass Vulnerability during SAML login in ServiceDesk Plus. As described by ManageEngine. If the target ServiceDesk Plus 11134 installation has SAML login enabled and you have credentials to a low privilege user then you can escalate to...

CVE-2019-12538

CVE-2019-12538 Zoho ManageEngine ServiceDesk Plus 9.3 XSS vulnerability in SiteLookup.do Information Description: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do qcsiteID parameter. Author: Concobe of Tarantula Team - VinCSS a member of Vingro...

CVE-2019-12542

CVE-2019-12542 Zoho ManageEngine ServiceDesk Plus 9.3 XSS vulnerability in SearchN.do Information Description: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter. Author: Concobe of Tarantula Team - VinCSS a member of Vingroup...

CVE-2019-12543

CVE-2019-12543 Zoho ManageEngine ServiceDesk Plus 9.3 XSS vulnerability in PurchaseRequest.do Information Description: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter. Author: Concobe of Tarantula Team - VinCSS ...

CVE-2019-12541

CVE-2019-12541 Zoho ManageEngine ServiceDesk Plus 9.3 XSS vulnerability in SolutionSearch.do Information Description: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter. Author: Concobe of Tarantula Team - VinCSS a member...

Zoho ManageEngine ServiceDesk Plus - Remote Code Execution

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. id: CVE-2021-44077 info: name: Zoho ManageEngine ServiceDesk Plus - Remote Code Execution author: Adam Crosser,gy741...

ManageEngine ServiceDesk RCE (CVE-2021-44077)

Exploits CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus: unauthenticated zip upload to /RestAPI/ImportTechnicians achieves path traversal and RCE. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine ServiceDesk Plus ImportTechnicians RCE CVE-2021-44077.""" import io import zipfile fro...

ManageEngine SDP - FileDownload.jsp fName File Read

Reads arbitrary files via ManageEngine ServiceDesk Plus FileDownload.jsp fName path traversal with null-byte truncation. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine ServiceDesk Plus FileDownload.jsp fName file read.""" from urllib.parse import quote from kittysploit import from...

ManageEngine SDP - FileDownload.jsp Path Traversal Detection

Detects ManageEngine ServiceDesk Plus FileDownload.jsp fName path traversal to /etc/passwd via null-byte truncation. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine ServiceDesk Plus FileDownload.jsp path traversal.""" import re from kittysploit import from lib.protocols.http.httpclient...

Zoho ManageEngine ServiceDesk Plus - Remote Code Execution Detection

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP befor...

CVE-2021-31530

Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure...

CVE-2021-31531

Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery SSRF...

CVE-2019-12543

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter...

CVE-2019-12541

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter...

CVE-2019-12189

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field...