CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 5.0
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: zoho manageengine opmanager before 12.3 build 123196 does not require authentication for /oputilsservlet requests, as demonstrated by a /oputilsservlet?action=getapikey request that can be leveraged against firewall analyzer to add an admin user via /api/json/v2/admin/adduser or conduct a sql injection attack via the /api/json/device/setmanaged name parameter.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/NONE
Published Date: 2018-09-21
Last Modified Date: 2018-11-09