SQL Injection and Remote Code Execution in Zoho ManageEngine Applications Manager
CVE-2019-11469 · HIGH Severity
AV:N/AC:L/AU:N/C:C/I:C/A:C
Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Subsequently, an unauthenticated user can gain the authority of SYSTEM on the server by uploading a malicious file via the "Execute Program Action(s)" feature.
Learn more about our Cis Benchmark Audit For Microsoft Sql Server.