PT-2012-3052 · Manageengine · Zoho Manageengine Applications Manager

Benjamin Kunz Mejri + 3 · Published 2012-02-14 · Updated 2017-08-29 · CVE-2012-1063

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 9.x through 10.x

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the viewId parameter to "fault/AlarmView.do" or the period parameter to "showHistoryData.do".

Recommendations For versions 9.x through 10.x, update to a version that contains a fix for this issue, as using these versions poses a significant risk due to the SQL injection vulnerabilities.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2012-1063

Affected Products

Zoho Manageengine Applications Manager

References · 6

• 🔥 http://packetstormsecurity.org/files/view/109238/VL-115.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-1063 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72831 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1063 · Note
• http://securityfocus.com/bid/51796 · Note
• http://vulnerability-lab.com/get_content.php?id=115 · Note