PT-2019-12328 · Zoho · Zoho Manageengine Applications Manager

Akkus + 1 · Published 2019-04-23 · Updated 2019-04-26 · CVE-2019-11469

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions 12 through 14

Description The issue allows for SQL injection via the FaultTemplateOptions.jsp resourceid. This can be exploited by an unauthenticated user to gain SYSTEM authority on the server. The exploitation involves uploading a malicious file using the "Execute Program Action(s)" feature.

Recommendations For versions 12 through 14, update to a version that contains a fix for this issue to prevent SQL injection and unauthorized access. As a temporary workaround, consider restricting access to the "Execute Program Action(s)" feature to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-11469

Affected Products

Zoho Manageengine Applications Manager

References · 6

• 🔥 http://packetstormsecurity.com/files/152607/ManageEngine-Applications-Manager-14.0-SQL-Injection-Command-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/46740 · Exploit
• 🔥 https://pentest.com.tr/exploits/ManageEngine-App-Manager-14-Auth-Bypass-Remote-Command-Execution.html · Exploit
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-11469.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11469 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11469 · Vendor Advisory