Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-17283 — SQL Injection in Manageengine Opmanager

CWE-89 — SQL Injection6 documents6 sources
Severity
7.5HIGHNVD
EPSS
27.9%
top 3.53%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Zohocorp Manageengine Opmanager
Timeline
PublishedSep 21
Latest updateDec 11

Description

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name parameter.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

🔴Vulnerability Details

3
GHSA
GHSA-44v2-pxvh-gf8w: Zoho ManageEngine OpManager before 12↗2022-05-14
▶
CVEList
CVE-2018-17283: Zoho ManageEngine OpManager before 12↗2018-09-21
▶
VulnCheck
Zoho manageengine_opmanager Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')↗2018
▶

💥Exploits & PoCs

1
Nuclei
Zoho ManageEngine OpManager - SQL Injection
▶

🔍Detection Rules

1
Suricata
ET WEB_SPECIFIC_APPS Zoho ManageEngine OpManager setManaged SQL Injection (CVE-2018-17283)↗2025-12-11
▶
CVE-2018-17283 — SQL Injection | cvebase