Zoho ManageEngine Applications Manager Multiple SQL Injection Vulnerabilities

Bugtraq ID:	102269
Class:	Input Validation Error
CVE:	CVE-2017-16542 CVE-2017-16543
Remote:	Yes
Local:	No
Published:	Nov 06 2017 12:00AM
Updated:	Nov 06 2017 12:00AM
Credit:	Cody Sixteen.
Vulnerable:	Zoho ManageEngine Applications Manager 13
Not Vulnerable:

Zoho ManageEngine Applications Manager Multiple SQL Injection Vulnerabilities

Zoho ManageEngine Applications Manager is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Zoho ManageEngine Applications Manager 13 is vulnerable; prior versions may also be affected.

Zoho ManageEngine Applications Manager Multiple SQL Injection Vulnerabilities

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

Zoho ManageEngine Applications Manager Multiple SQL Injection Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Zoho ManageEngine Applications Manager Multiple SQL Injection Vulnerabilities

References:

• Manage Engine Homepage (ManageEngine)
  
• SQL Injection in ManageEngine Applications Manager 13 (code610)
  
• Zoho Homepage (Zoho)