Unscored CVE-2017-16850 EUVD-2017-8024GHSA-2ggx-jwwc-p8hr

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a getRes…

Published Nov 16, 2017 · Updated Aug 5, 2024 · Assigned by mitre

Description

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a getResourceProfiles action.

References

https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2017-16850.html
http://code610.blogspot.com/2017/11/more-sql-injections-in-manageengine.html