CVE-2019-11469

CRITICAL 9.8CVE-2019-11469 · Published 23/04/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
manageengine applications manager zohocorp	`≥ 12.0, ≤ 14.0`	No fix yet

Description

Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Subsequently, an unauthenticated user can gain the authority of SYSTEM on the server by uploading a malicious file via the "Execute Program Action(s)" feature.

References

packetstormsecurity.com/files/152607/ManageEngine-Applications-Manager-14.0-SQL-Injection-Command-Injection.html · Exploit
pentest.com.tr/exploits/ManageEngine-App-Manager-14-Auth-Bypass-Remote-Command-Execution.html · Exploit
exploit-db.com/exploits/46740 · Exploit
exploit-db.com/exploits/46740 · Exploit
manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-11469.html · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free