ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities
23Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendepss 4.8%
da publicação à arma782 dias
Publicada no NVD5 de jun.
1ª PoC+782d
probabilidade de exploração
4.8%top 9% das CVEs
exploração observada
nãonenhuma fonte reporta
3 exploit(s) público(s)
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, which are MD5 hashes without salt, and, depending on the database type and its configuration, could also execute operating system commands using SQL queries.
Produtos afetados
ManageEngine · Applications ManagerPoCs públicas encontradas — 3
exploitdbwww.exploit-db.com/exploits/48692não verificadocve_referencepacketstormsecurity.com/files/158554/ManageEngine-Applications-Manager-13-SQL-Injection.htmlnão verificadocve_referencepacketstormsecurity.com/files/142022/ManageEngine-Applications-Manager-12-13-XSS-SQL-Injection-Code-Execution.htmlnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
http://packetstormsecurity.com/files/158554/ManageEngine-Applications-Manager-13-SQL-Injection.htmlhttp://seclists.org/fulldisclosure/2017/Apr/9https://packetstormsecurity.com/files/142022/ManageEngine-Applications-Manager-12-13-XSS-SQL-Injection-Code-Execution.htmlhttps://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9488.htmlhttp://www.securityfocus.com/bid/97394