PT-2019-12313 · Zoho · Zoho Manageengine Applications Manager

Akkus + 1 · Publicado 2019-04-22 · Atualizado 2019-05-06 · CVE-2019-11448

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions 11.0 through 14.0

Description An issue allows an unauthenticated user to gain SYSTEM authority on the server due to a SQL injection vulnerability in Popup SLA.jsp. This can lead to writing arbitrary text to a .vbs file.

Recommendations For Zoho ManageEngine Applications Manager versions 11.0 through 14.0, consider restricting access to the Popup SLA.jsp page until a fix is available. As a temporary workaround, limit the ability to write to .vbs files on the server to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-11448

Produtos afetados

Zoho Manageengine Applications Manager

Referências · 5

• 🔥 https://exploit-db.com/exploits/46725 · Exploit
• 🔥 https://pentest.com.tr/exploits/ManageEngine-App-Manager-14-SQLi-Remote-Code-Execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-11448 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11448 · Nota de Segurança
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-11448.html · Aviso do Fabricante