ZOHO ManageEngine OpManager CVE-2018-18949 SQL Injection Vulnerability

Bugtraq ID:	108760
Class:	Input Validation Error
CVE:	CVE-2018-18949
Remote:	Yes
Local:	No
Published:	Nov 05 2018 12:00AM
Updated:	Nov 05 2018 12:00AM
Credit:	Hakan Bayir.
Vulnerable:	ZOHO Corporation ManageEngine OpManager 12.3 Build 123221 ZOHO Corporation ManageEngine OpManager 12.3
Not Vulnerable:	ZOHO Corporation ManageEngine OpManager 12.3 Build 123222

ZOHO ManageEngine OpManager CVE-2018-18949 SQL Injection Vulnerability

ZOHO ManageEngine OpManager is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to ManageEngine OpManager 12.3 build 123222 are vulnerable.

ZOHO ManageEngine OpManager CVE-2018-18949 SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

ZOHO ManageEngine OpManager CVE-2018-18949 SQL Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

ZOHO ManageEngine OpManager CVE-2018-18949 SQL Injection Vulnerability

References:

• Manage Engine Home Page (Manage Engine)
  
• Manage Engine OpManager Product Page (Manage Engine)
  
• Manage Engine Releases Notes (Manage Engine)
  
• Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server (Zoho Corporation)