HTTP: Zoho ManageEngine Applications Manager CVE-2019-11469 SQLI
This signature detects attempts to exploit a known vulnerability against Zoho ManageEngine Applications Manager. A successful attack can lead to sql injection.
Extended Description
Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Subsequently, an unauthenticated user can gain the authority of SYSTEM on the server by uploading a malicious file via the "Execute Program Action(s)" feature.
Affected Products
Zohocorp manageengine_applications_manager
References
CVE: CVE-2019-11469
Short Name
HTTP:SQL:ZOHO-MANAGE
Severity
Major
Recommended
True
Recommended Action
Drop
Category
HTTP
Keywords
Applications CVE-2019-11469 ManageEngine Manager SQLI Zoho
Release Date
06/20/2019
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3415
False Positive
Unknown
Vendors
Zohocorp
CVSS Score
10.0