packetstormsecurity.com
http://packetstormsecurity.com/files/158554/ManageEngine-Applications-Manager-13-SQL-Injection.html CVE-2016-9488
CRITICAL
ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities
Record summary
CVE-2016-9488 has a selected CVSS score of 9.8 (critical); EIP currently links 1 catalogued exploit.
Description
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, which are MD5 hashes without salt, and, depending on the database type and its configuration, could also execute operating system commands using SQL queries.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Applications ManagerBrowse ManageEngine / Applications Manager | CVE List | 12 | affected |
| 13 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBManageEngine Applications Manager 13 - 'MenuHandlerServlet' SQL InjectionExploitDB exploitby aldormNot analyzed1 file
References
620170404 ManageEngine Applications Manager Multiple Vulnerabilitiesmailing list
http://seclists.org/fulldisclosure/2017/Apr/9 97394vdb entry
http://www.securityfocus.com/bid/97394 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2016-9488 packetstormsecurity.com
https://packetstormsecurity.com/files/142022/ManageEngine-Applications-Manager-12-13-XSS-SQL-Injection-Code-Execution.html manageengine.comConfirmation
https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9488.html