CVE-2018-15168 - A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?method=editDisplaynames GET request

Back Back to CVE browser

CRITICAL

A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?method=editDisplaynames GET request

Published Aug 8, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 3.94%

Description

A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?method=editDisplaynames GET request.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

https://github.com/x-f1v3/ForCve/issues/2
x_refsource_MISCExploitThird Party Advisory
https://www.manageengine.com/products/applications_manager/issues.html
x_refsource_MISCRelease NotesVendor Advisory
https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-15168.html
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://github.com/x-f1v3/ForCve/issues/2		x_refsource_MISCExploitThird Party Advisory
https://www.manageengine.com/products/applications_manager/issues.html		x_refsource_MISCRelease NotesVendor Advisory
https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-15168.html		x_refsource_CONFIRMVendor Advisory