CVE-2017-16543

Critical

Published: 05/11/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Zoho ManageEngine Applications Manager version 13 before build 13500 is vulnerable to SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter.

Risk Assessment

An attacker could exploit this vulnerability to execute unauthorized queries against the database, potentially leading to the disclosure of sensitive information or system compromise.

Recommendation

It is recommended to upgrade to the latest version of Zoho ManageEngine Applications Manager to mitigate this vulnerability and conduct a security audit of the application.

Original NVD description (English source)

Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter.