low3.5Public exploit code
CVE-2015-5150
Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web scrip…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ManageEngine SupportCenter Plus 7.90 - Multiple Vulnerabilities2015-06-19 · webapps · multiple
Impact
Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the (1) query parameter in the run_query_editor_query module to CustomReportHandler.do, (2) compAcct parameter to jsp/ResetADPwd.jsp, or (3) redirectTo parameter to jsp/CacheScreenWidth.jsp.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zohocorp | Manageengine Supportcenter Plus | Version 7.90 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/132376/ManageEngine-SupportCenter-Plus-7.90-XSS-Traversal-Password-Disclosure.html
- http://www.vulnerability-lab.com/get_content.php?id=1501
- https://www.exploit-db.com/exploits/37322/
- http://packetstormsecurity.com/files/132376/ManageEngine-SupportCenter-Plus-7.90-XSS-Traversal-Password-Disclosure.html
- http://www.vulnerability-lab.com/get_content.php?id=1501
- https://www.exploit-db.com/exploits/37322/