PT-2012-3052 · Manageengine · Zoho Manageengine Applications Manager

Benjamin Kunz Mejri + 3 · Publicado 2012-02-14 · Atualizado 2017-08-29 · CVE-2012-1063

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 9.x through 10.x

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the viewId parameter to "fault/AlarmView.do" or the period parameter to "showHistoryData.do".

Recommendations For versions 9.x through 10.x, update to a version that contains a fix for this issue, as using these versions poses a significant risk due to the SQL injection vulnerabilities.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2012-1063

Produtos afetados

Zoho Manageengine Applications Manager

Referências · 6

• 🔥 http://packetstormsecurity.org/files/view/109238/VL-115.txt · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72831 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1063 · Nota
• http://securityfocus.com/bid/51796 · Nota
• http://vulnerability-lab.com/get_content.php?id=115 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1063 · Nota de Segurança