vendor:
Application Manager
by:
Mehmet Ince
9.8
CVSS
CRITICAL
Command Injection
78
CWE
Product Name: Application Manager
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: CVE-2018-7890
CPE: N/A
Other Scripts:
N/A
Platforms Tested: Windows
2018
ManageEngine Applications Manager Remote Code Execution
This module exploits command injection vulnerability in the ManageEngine Application Manager product. An unauthenticated user can execute a operating system command under the context of privileged user. Publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing given system. This endpoint calls a several internal classes and then executes powershell script without validating user supplied parameter when the given system is OfficeSharePointServer.
Mitigation:
No known mitigation or remediation for this vulnerability