QID 375804

ADManager Plus is an integrated Active Directory (AD), Exchange Server, Office 365, Skype for Business (Lync), and G Suite management and reporting solution. This tool allows you to securely delegate OU and group-based AD tasks to help desk technicians.

Zoho ManageEngine ADManager Plus has self-XSS and HTML injection vulnerability (CVE-2018-15609)

Affected Versions:
ADManager Plus prior to build number 6650

QID Detection Logic (Authenticated):
This QID checks for vulnerable version of Zoho Manage Engine ADManager Plus by checking the build number in "product.conf" file.

The attacker could transfer private information, such as cookies that may include session information, from the victim's machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site. Phishing attacks could be used to emulate trusted web sites and trick the victim into entering a password, allowing the attacker to compromise the victim's account on that web site