CVE-2016-9488: ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, which are MD5 hashes without salt, and, depending on the database type and its configuration, could also execute operating system commands using SQL queries.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2016-9488?
CVE-2016-9488 is a vulnerability in ManageEngine Applications Manager versions 12 and 13 before build 13200 that allows remote SQL injection attacks.
How severe is CVE-2016-9488?
CVE-2016-9488 has a severity score of 9.8, which is considered critical.
Which software is affected by CVE-2016-9488?
ManageEngine Applications Manager versions 12 and 13 before build 13200 are affected by CVE-2016-9488.
How can an attacker exploit CVE-2016-9488?
An unauthenticated attacker can exploit CVE-2016-9488 by accessing the vulnerable URL /servlet/MenuHandlerServlet and performing SQL injection attacks.
Are there any references for CVE-2016-9488?
Yes, you can find more information about CVE-2016-9488 at the following references: [Reference 1](http://packetstormsecurity.com/files/158554/ManageEngine-Applications-Manager-13-SQL-Injection.html), [Reference 2](http://seclists.org/fulldisclosure/2017/Apr/9), [Reference 3](http://www.securityfocus.com/bid/97394)