CVE-2012-1063 Multiple SQL injection vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to execute arbitrary SQL commands via the (1) viewId parameter to fault/AlarmView.do or....
HighCVSS 7.5
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to execute arbitrary SQL commands via the (1) viewId parameter to fault/AlarmView.do or (2) period parameter to showHistoryData.do.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ManageEngine applications manager | = 10.0 | No fix listed |
| ManageEngine applications manager | = 10.1 | No fix listed |
| ManageEngine applications manager | = 10.2 | No fix listed |
| ManageEngine applications manager | = 10.3 | No fix listed |
| ManageEngine applications manager | = 9.1 | No fix listed |
| ManageEngine applications manager | = 9.2 | No fix listed |
| ManageEngine applications manager | = 9.3 | No fix listed |
| ManageEngine applications manager | = 9.4 | No fix listed |
| ManageEngine applications manager | = 9.5 | No fix listed |
References
- packetstormsecurity.org exploit
- 51796 vdb-entry
- www.vulnerability-lab.com
- meapplication-multiple-sql-injection(72831) vdb-entry