CVE-2019-11448

CRITICAL 9.8CVE-2019-11448 · Published 22/04/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
manageengine applications manager zohocorp	`≥ 11.0, ≤ 14.0`	No fix yet

Description

An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a Popup_SLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file.

References

pentest.com.tr/exploits/ManageEngine-App-Manager-14-SQLi-Remote-Code-Execution.html · Exploit
exploit-db.com/exploits/46725 · Exploit
exploit-db.com/exploits/46725 · Exploit
manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-11448.html · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free