ZOHO ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2017-37248)

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. A SQL injection...

CVE-2017-16846

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter...

CVE-2017-16850

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a getResourceProfiles action...

CVE-2017-16846

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter...

CVE-2017-16851

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter...

CVE-2017-16849

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter...

CVE-2017-16851

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter...

CVE-2017-16847: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a showPlasmaView action...

PT-2017-14592

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager version 13 before build 13530 Description The issue allows SQL injection via the "/showresource.do" API endpoint, specifically through the resourceid parameter in a showPlasmaView action. Recommendations...

PT-2017-14594

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager version 13 before build 13530 Description The issue allows SQL injection via the "MyPage.do?method=viewDashBoard" endpoint for the forpage parameter. Recommendations For Zoho ManageEngine Applications...

PT-2017-14595

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager version 13 before build 13530 Description The issue allows SQL injection via the "showresource.do" endpoint, specifically through the resourceid parameter in a getResourceProfiles action. Recommendations...

PT-2017-14591

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager version 13 before build 13530 Description The issue allows SQL injection via the "haid" parameter in the "/manageApplications.do?method=AddSubGroup" API endpoint. Recommendations For Zoho ManageEngine...

PT-2017-14593

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager version 13 Description The issue allows SQL injection via the "/manageConfMons.do" API endpoint, specifically through the groupname parameter. Recommendations For Zoho ManageEngine Applications Manager...

PT-2017-14596

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager version 13 before build 13530 Description The issue allows SQL injection via the "widgetid" parameter in the /MyPage.do endpoint. Recommendations For Zoho ManageEngine Applications Manager version 13 befo...

CVE-2017-16851: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter...

CVE-2017-16848: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter...

CVE-2017-16849: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter...

CVE-2017-16850: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a getResourceProfiles action...

CVE-2017-16846: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter...

ManageEngine Applications Manager 13 - SQL Injection

ManageEngine Applications Manager 13 - SQL Injection ManageEngine Applications Manager version 13 suffers from multiple post-authentication SQL injection vulnerabilities. Proof of Concept 1 name= parameter is susceptible: POST /manageApplications.do?method=insert HTTP/1.1 Host: 192.168.1.190:9090...