CVE-2019-15104: SQL Injection
An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious file using the "Execute Program Action(s)" feature.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-15104?
The severity of CVE-2019-15104 is critical.
What is the affected software of CVE-2019-15104?
The affected software of CVE-2019-15104 is Zohocorp Manageengine Applications Manager version 12.0 to 14.0.
What is the vulnerability type of CVE-2019-15104?
CVE-2019-15104 is a SQL Injection vulnerability.
How can a low-authority user exploit CVE-2019-15104?
A low-authority user can exploit CVE-2019-15104 by injecting SQL code through the resourceid parameter in jsp/NewThresholdConfiguration.jsp, allowing them to gain SYSTEM authority on the server.
Are there any security updates available for CVE-2019-15104?
Yes, there are security updates available for CVE-2019-15104. Please refer to the ManageEngine Applications Manager website for more information.