code610.blogspot.com
http://code610.blogspot.com/2017/11/sql-injection-in-manageengine.html CVE-2017-16542
HIGH
ManageEngine Applications Manager 13 - SQL Injection
Record summary
CVE-2017-16542 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit.
Description
Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBManageEngine Applications Manager 13 - SQL InjectionExploitDB exploitby Cody SixteenNot analyzed1 file
References
4nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2017-16542 43129exploit
https://www.exploit-db.com/exploits/43129 manageengine.comConfirmation
https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2017-16542.html