critical9.8Public exploit code
CVE-2019-11448
An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ManageEngine Applications Manager 11.0 < 14.0 - SQL Injection / Remote Code Execution (Metasploit)2019-04-18 · remote · windows
Impact
An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a Popup_SLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zohocorp | Manageengine Applications Manager | from 11.0 through 14.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://pentest.com.tr/exploits/ManageEngine-App-Manager-14-SQLi-Remote-Code-Execution.html
- https://www.exploit-db.com/exploits/46725
- https://www.exploit-db.com/exploits/46725/
- https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-11448.html
- https://pentest.com.tr/exploits/ManageEngine-App-Manager-14-SQLi-Remote-Code-Execution.html
- https://www.exploit-db.com/exploits/46725
- https://www.exploit-db.com/exploits/46725/
- https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-11448.html