Critical severity · published Jun 5, 2018
CVE-2016-9488
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities
9.8
CVSS
4.6%
EPSS
No
On KEV
Description
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, which are MD5 hashes without salt, and, depending on the database type and its configuration, could also execute operating system commands using SQL queries.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.6% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Applications Manager · Manageengine
12.0; 13.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-9488
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-9488
packetstormsecurity.com
http://packetstormsecurity.com/files/158554/ManageEngine-Applications-Manager-13-SQL-Injection.html
Mailing List
http://seclists.org/fulldisclosure/2017/Apr/9
Third Party Advisory
http://www.securityfocus.com/bid/97394
Third Party Advisory
https://packetstormsecurity.com/files/142022/ManageEngine-Applications-Manager-12-13-XSS-SQL-Injection-Code-Execution.html
www.manageengine.com
https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9488.html
More from Applications Manager
6.5
CVE-2024-41140
Improper Authorization
6.1
CVE-2016-9490
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability
5.4
CVE-2025-27930
Zohocorp ManageEngine Applications Manager versions 176600 and prior are vulnerable to stored cross-site scripting in the File/Directory monitor.
–
CVE-2012-1063
Multiple SQL injection vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to execute arbitrary SQL commands via the (1) viewId parameter to…
–
CVE-2012-1062
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1)…