CVE-2019-11448

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

12.43%

Published

Apr 22, 2019

Modified

Nov 21, 2024

Public PoC / Exploit (2)

All weaponized →

Exploit-DBManageEngine Applications Manager 11.0 < 14.0 - SQL Injection / Remote Code Execution (Metasploit)TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a Popup_SLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file.

Weaknesses (CWE)

CWE-89

Affected Products (1)

zohocorp · manageengine_applications_managervulnerable

References (8)

https://pentest.com.tr/exploits/ManageEngine-App-Manager-14-SQLi-Remote-Code-Execution.html

ExploitThird Party Advisory

https://www.exploit-db.com/exploits/46725

ExploitThird Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/46725/

ExploitThird Party AdvisoryVDB Entry

https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-11448.html