Sql injection

An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a PopupSLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file...

CVE-2019-11448

An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a PopupSLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file...

CVE-2019-11448

The credentials-independent SQL injection vulnerability CVE-2019-11448 affects Zoho ManageEngine Applications Manager versions 11.0–14.0, exploitable via Popup_SLA.jsp SID parameter. The flaw allows an unauthenticated attacker to gain SYSTEM-level access on the server, enabling arbitrary text wri...

PT-2019-12313

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions 11.0 through 14.0 Description An issue allows an unauthenticated user to gain SYSTEM authority on the server due to a SQL injection vulnerability in Popup SLA.jsp. This can lead to writing...

CVE-2019-11448: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a PopupSLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file...

ManageEngine Applications Manager 11.0 14.0 - SQL Injection Remote Code Execution (Metasploit)

ManageEngine Applications Manager 11.0 14.0 - SQL Injection Remote Code Execution Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ManageEngine Applications Manager 11.0 %q This module...

ManageEngine Applications Manager 11.0 < 14.0 - SQL Injection / Remote Code Execution Exploit

This Metasploit module exploits SQL injection and command injection vulnerabilities in ManageEngine AM 14 and prior versions. An unauthenticated user can gain the authority of "system" on the server due to the SQL injection vulnerability. The exploit allows the writing of the desired file to the...

ManageEngine Applications Manager 11.0 < 14.0 - SQL Injection / Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ManageEngine Applications Manager 11.0 %q This module exploits sql and command injection vulnerability in the ManageEngine AM 14 and prior version...