CVE-2017-16543: SQL Injection
Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-16543?
CVE-2017-16543 is a SQL injection vulnerability in Zoho ManageEngine Applications Manager 13 before build 13500.
How does CVE-2017-16543 impact Zoho ManageEngine Applications Manager?
CVE-2017-16543 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter.
What is the severity of CVE-2017-16543?
The severity of CVE-2017-16543 is critical with a CVSS score of 9.8.
How can I fix CVE-2017-16543 in Zoho ManageEngine Applications Manager?
To fix CVE-2017-16543, you should update Zoho ManageEngine Applications Manager to build 13500 or later.
Where can I find more information about CVE-2017-16543?
You can find more information about CVE-2017-16543 at the following references: [http://code610.blogspot.com/2017/11/sql-injection-in-manageengine.html](http://code610.blogspot.com/2017/11/sql-injection-in-manageengine.html), [https://www.exploit-db.com/exploits/43129/](https://www.exploit-db.com/exploits/43129/), [https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2017-16543.html](https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2017-16543.html)