CVE-2017-16848

Critical

Published: 16/11/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Zoho ManageEngine Applications Manager 13 is vulnerable to SQL injection via the groupname parameter in /manageConfMons.do.

Risk Assessment

An attacker could exploit this vulnerability to gain unauthorized access to the database, potentially leading to the disclosure of sensitive information.

Recommendation

It is recommended to upgrade to the latest version of the software to mitigate this vulnerability and to monitor logs for potential attack attempts.

Original NVD description (English source)

Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter.