PT-2019-12328 · Zoho · Zoho Manageengine Applications Manager

Akkus + 1 · Publicado 2019-04-23 · Atualizado 2019-04-26 · CVE-2019-11469

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions 12 through 14

Description The issue allows for SQL injection via the FaultTemplateOptions.jsp resourceid. This can be exploited by an unauthenticated user to gain SYSTEM authority on the server. The exploitation involves uploading a malicious file using the "Execute Program Action(s)" feature.

Recommendations For versions 12 through 14, update to a version that contains a fix for this issue to prevent SQL injection and unauthorized access. As a temporary workaround, consider restricting access to the "Execute Program Action(s)" feature to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-11469

Produtos afetados

Zoho Manageengine Applications Manager

Referências · 6

• 🔥 http://packetstormsecurity.com/files/152607/ManageEngine-Applications-Manager-14.0-SQL-Injection-Command-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/46740 · Exploit
• 🔥 https://pentest.com.tr/exploits/ManageEngine-App-Manager-14-Auth-Bypass-Remote-Command-Execution.html · Exploit
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-11469.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11469 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-11469 · Aviso do Fabricante