CVE-2018-17283

HIGHNuclei

Zoho manageengine_opmanager Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2018-17283 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name parameter.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 6, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

manageengine_opmanager

Browse Zoho / manageengine_opmanager
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryHIGHZoho ManageEngine OpManager - SQL InjectionCVSS 7.5

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name parameter.

Impact

Unauthenticated attackers can execute SQL injection attacks to access or modify database contents, add administrator users, or extract sensitive information including credentials.

Remediation

Upgrade to ManageEngine OpManager version 12.3 Build 123196 or later.

WeaknessesCWE-89
AuthorsDhiyaneshDK
Template tagscvecve2018oputilszohoopmanagersqlitime-based-sqlivkevvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*
Shodan: http.title:"OpManager"
FOFA: title="OpManager"
https://github.com/x-f1v3/forcve/issues/4 https://nvd.nist.gov/vuln/detail/CVE-2018-17283

Source: ProjectDiscovery

References

3