PT-2019-12313 · Zoho · Zoho Manageengine Applications Manager

Akkus + 1 · Published 2019-04-22 · Updated 2019-05-06 · CVE-2019-11448

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions 11.0 through 14.0

Description An issue allows an unauthenticated user to gain SYSTEM authority on the server due to a SQL injection vulnerability in Popup SLA.jsp. This can lead to writing arbitrary text to a .vbs file.

Recommendations For Zoho ManageEngine Applications Manager versions 11.0 through 14.0, consider restricting access to the Popup SLA.jsp page until a fix is available. As a temporary workaround, limit the ability to write to .vbs files on the server to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-11448

Affected Products

Zoho Manageengine Applications Manager

References · 5

• 🔥 https://exploit-db.com/exploits/46725 · Exploit
• 🔥 https://pentest.com.tr/exploits/ManageEngine-App-Manager-14-SQLi-Remote-Code-Execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-11448 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11448 · Security Note
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-11448.html · Vendor Advisory