CVE-2018-7890: OS Command Injection
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal classes, and then executes a PowerShell script. If the specified system is OfficeSharePointServer, then the username and password parameters to this script are not validated, leading to Command Injection.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-7890?
CVE-2018-7890 is a remote code execution issue in Zoho ManageEngine Applications Manager before 13.6.
What is the severity of CVE-2018-7890?
CVE-2018-7890 has a severity rating of 9.8, which is classified as critical.
How does CVE-2018-7890 affect Zoho ManageEngine Applications Manager?
CVE-2018-7890 allows remote code execution, potentially compromising the security of Zoho ManageEngine Applications Manager before version 13.6.
How can I fix CVE-2018-7890?
To fix CVE-2018-7890, it is recommended to upgrade Zoho ManageEngine Applications Manager to version 13.6 or later.
Are there any references for CVE-2018-7890?
Yes, here are some references for CVE-2018-7890: - SecurityFocus: http://www.securityfocus.com/bid/103358 - Metasploit Framework: https://github.com/rapid7/metasploit-framework/pull/9684 - PenTest Blog Advisory: https://pentest.blog/advisory-manageengine-applications-manager-remote-code-execution-sqli-and/