SQL Injection and Remote Code Execution in Zoho ManageEngine Applications Manager

SQL Injection and Remote Code Execution in Zoho ManageEngine Applications Manager

CVE-2019-11469 · HIGH Severity

AV:N/AC:L/AU:N/C:C/I:C/A:C

Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Subsequently, an unauthenticated user can gain the authority of SYSTEM on the server by uploading a malicious file via the "Execute Program Action(s)" feature.

Learn more about our Cis Benchmark Audit For Microsoft Sql Server.