CVE-2016-9488: ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities
First published: Tue Jun 05 2018(Updated: )
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, which are MD5 hashes without salt, and, depending on the database type and its configuration, could also execute operating system commands using SQL queries.
Credit: cret@cert.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ManageEngine Applications Manager | =12.0 | |
| ManageEngine Applications Manager | =13.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/158554/ManageEngine-Applications-Manager-13-SQL-Injection.html
- http://seclists.org/fulldisclosure/2017/Apr/9
- http://www.securityfocus.com/bid/97394
- https://packetstormsecurity.com/files/142022/ManageEngine-Applications-Manager-12-13-XSS-SQL-Injection-Code-Execution.html
- https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9488.html
Frequently Asked Questions
What is CVE-2016-9488?
CVE-2016-9488 is a vulnerability in ManageEngine Applications Manager versions 12 and 13 before build 13200 that allows remote SQL injection attacks.
How severe is CVE-2016-9488?
CVE-2016-9488 has a severity score of 9.8, which is considered critical.
Which software is affected by CVE-2016-9488?
ManageEngine Applications Manager versions 12 and 13 before build 13200 are affected by CVE-2016-9488.
How can an attacker exploit CVE-2016-9488?
An unauthenticated attacker can exploit CVE-2016-9488 by accessing the vulnerable URL /servlet/MenuHandlerServlet and performing SQL injection attacks.
Are there any references for CVE-2016-9488?
Yes, you can find more information about CVE-2016-9488 at the following references: [Reference 1](http://packetstormsecurity.com/files/158554/ManageEngine-Applications-Manager-13-SQL-Injection.html), [Reference 2](http://seclists.org/fulldisclosure/2017/Apr/9), [Reference 3](http://www.securityfocus.com/bid/97394)
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/author
- agent/softwarecombine
- agent/tags
- agent/event
- agent/description
- agent/first-publish-date
- vendor/manageengine
- canonical/manageengine applications manager
- version/manageengine applications manager/12.0
- version/manageengine applications manager/13.0