CVE-2017-16849

Critical

Published: 16/11/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the forpage parameter in the /MyPage.do?method=viewDashBoard request.

Risk Assessment

Exploitation of this vulnerability could lead to unauthorized access to the database, jeopardizing the integrity and confidentiality of the organization's data.

Recommendation

It is recommended to upgrade Zoho ManageEngine Applications Manager to version 13 build 13530 or later to mitigate this vulnerability.

Original NVD description (English source)

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter.