vulnwire
9.8crit

CVE-2016-94881 exploit

ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities

Published 8 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.6%
percentile 92%
Public exploits
1
Exploit-DB

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, which are MD5 hashes without salt, and, depending on the database type and its configuration, could also execute operating system commands using SQL queries.

Exploit prediction (EPSS)

4.62% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.

Exploits and detections

  • EDB-48692 ManageEngine Applications Manager 13 - 'MenuHandlerServlet' SQL Injection · webapps · 2020-07-26

CVSS scores

Assigned byVersionScoreVector
NVD3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • ManageEngine Applications Manager

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

  • seclists.org /fulldisclosure/2017/Apr/9 · mailing-list, x_refsource_FULLDISC, x_transferred
  • packetstormsecurity.com /files/142022/ManageEngine-Applications-Manager-12-13-XSS-SQL-Injection-Code-Execution.htm · x_refsource_MISC, x_transferred
  • manageengine.com /products/applications_manager/security-updates/security-updates-cve-2016-9488.html · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/97394 · vdb-entry, x_refsource_BID, x_transferred
  • packetstormsecurity.com /files/158554/ManageEngine-Applications-Manager-13-SQL-Injection.html · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.