CVE-2017-16846: SQL Injection
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-16846?
CVE-2017-16846 is a vulnerability in Zoho ManageEngine Applications Manager 13 before build 13530 that allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter.
How severe is CVE-2017-16846?
CVE-2017-16846 is classified as critical with a severity value of 9.8.
How can I fix CVE-2017-16846?
To fix CVE-2017-16846, update Zoho ManageEngine Applications Manager to build 13530 or later.
Is there any reference material available for CVE-2017-16846?
Yes, you can find reference material for CVE-2017-16846 at the following links: [Link1](http://code610.blogspot.com/2017/11/more-sql-injections-in-manageengine.html), [Link2](https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2017-16846.html).
What is the CWE classification for CVE-2017-16846?
CVE-2017-16846 is classified under CWE-89, which is for SQL Injection vulnerabilities.