ZOHO ManageEngine OpManager Hardcoded Credentials Vulnerability

ZOHO ManageEngine OpManager is network performance management software. A hard-coded credentials vulnerability exists in ZOHO ManageEngine OpManager. A remote attacker could exploit this vulnerability to gain administrator access...

Authentication flaw

PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT//INTO."...

CVE-2015-7766

PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT//INTO."...

CVE-2015-7765

CVE-2015-7765 affects ManageEngine OpManager (11.5 build 11600 and earlier) and is rooted in a hardcoded IntegrationUser password: "plugin". The vulnerability allows remote authenticated users to obtain administrator access by leveraging this credential, enabling the exploitation of the applicati...

CVE-2015-7766

CVE-2015-7766 affects Zoho ManageEngine OpManager 11.6, 11.5 and earlier. The issue in PGSQL:SubmitQuery.do lets remote admins bypass SQL query restrictions by inserting a comment into requests to api/json/admin/SubmitQuery (e.g., "INSERT/**/INTO"). Public references describe this as a SQL query ...

PT-2015-7595

Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine OpManager versions 11.5 build 11600 and earlier Description The issue allows remote authenticated users to obtain administrator access by leveraging knowledge of a hardcoded password. The hardcoded password is used for the...

PT-2015-7596

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions 11.6, 11.5, and earlier Description The issue allows remote administrators to bypass SQL query restrictions. This can be achieved by including a comment in the query to the "api/json/admin/SubmitQuery" API...

CVE-2015-7765: Undefined Security Weakness

ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password...

CVE-2015-7766: Undefined Security Weakness

PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT//INTO."...

ManageEngine ServiceDesk Plus Arbitrary File Upload

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'ManageEngine ServiceDesk Plus Arbitrary File Upload', 'Description' = %q This module exploits a file upload vulnerability in...

ManageEngine ServiceDesk Plus Arbitrary File Upload Exploit

This Metasploit module exploits a file upload vulnerability in ManageEngine ServiceDesk Plus. The vulnerability exists in the FileUploader servlet which accepts unauthenticated file uploads. This Metasploit module has been tested successfully on versions v9 b9000 - b9102 in Windows and Linux. The...

ManageEngine OpManager APMAlertOperationsServlet source SQL Injection

An SQL injection vulnerability exists in ManageEngine OpManager. This vulnerability is due to insufficient validation of the source parameter when processing requests sent to APMAlertOperationsServlet servlet. A remote attacker can exploit this vulnerability to inject and execute arbitrary SQL co...

ManageEngine ServiceDesk Plus 9.1 Build 9110 Path Traversal

Exploit Title: ManageEngine ServiceDesk Plus Product Description ------------------- ServiceDesk Plus is an ITIL ready IT help desk software for organizations of all sizes. With advanced ITSM functionality and easy-to-use capability, ServiceDesk Plus helps IT support teams deliver world-class...

ManageEngine ServiceDesk File Upload Directory Traversal

A directory traversal vulnerability exists in ManageEngine ServiceDesk. The specific flaw occurs in the way the vulnerable product extracts uploaded ZIP files. An authenticated attacker can exploit this vulnerability to upload arbitrary files to the target server which could further lead to...

ManageEngine ServiceDesk File Upload / Code Execution

Hi, Yet another RCE bug in ManageEngine ServiceDesk. This was disclosed by ZDI under ID ZDI-15-396 on August 20th, and fixed in version 9103 1. Details below, full advisory can be obtained from my repo at E2. A Metasploit module that exploits this vulnerability has been submitted upstream in E3...

ManageEngine ServiceDesk Plus <= 9.1 build 9110 - Path Traversal Vulnerability

Exploit for jsp platform in category web applications Exploit Title: ManageEngine ServiceDesk Plus Product Description ------------------- ServiceDesk Plus is an ITIL ready IT help desk software for organizations of all sizes. With advanced ITSM functionality and easy-to-use capability, ServiceDe...

ManageEngine ServiceDesk Plus 9.1 build 9110 - Directory Traversal

Exploit Title: ManageEngine ServiceDesk Plus Product Description ------------------- ServiceDesk Plus is an ITIL ready IT help desk software for organizations of all sizes. With advanced ITSM functionality and easy-to-use capability, ServiceDesk Plus helps IT support teams deliver world-class...

ManageEngine ServiceDesk Plus 9.1 build 9110 - Directory Traversal

ManageEngine ServiceDesk Plus 9.1 build 9110 - Directory Traversal Exploit Title: ManageEngine ServiceDesk Plus Product Description ------------------- ServiceDesk Plus is an ITIL ready IT help desk software for organizations of all sizes. With advanced ITSM functionality and easy-to-use...

ManageEngine ServiceDesk Plus Path Traversal

This module exploits an unauthenticated path traversal vulnerability found in ManageEngine ServiceDesk Plus build 9110 and lower. The module will retrieve any file on the filesystem with the same privileges as Support Center Plus is running. On Windows, files can be retrieved with SYSTEM...

ManageEngine EventLog Analyzer Remote Code Execution Exploit

Exploit for windows platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'ManageEngine EventLog Analyzer Remote Code Execution', 'Description' = %q...