cbcvebase.
CVE-2018-18949
published 2018-11-05

CVE-2018-18949: Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings.

PriorityP266critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
24.50%
97.6th percentile
Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings.

Affected

3 ranges
VendorProductVersion rangeFixed in
zohocorpmanageengine_opmanager——
zohocorpmanageengine_opmanager——
zohocorpmanageengine_opmanager——

Detection & IOCsextracted from sources · hover to see the quote

url/admin/ConfigureMailServerSettings
url/admin/ConfigureMailServerSettings?
  • →M1: Detect POST-based SQL injection via the mailservername parameter. Look for HTTP requests to /admin/ConfigureMailServerSettings with a request body containing 'name="mailservername"' followed by SQL injection characters (', ", ;, -, \, *, /) or their URL-encoded equivalents (%22, %27, %2a, %2d, %2f, %3b, %5c) in the body after a CRLF.
  • →M2: Detect GET-based SQL injection via the mailserverport parameter. Look for HTTP requests to /admin/ConfigureMailServerSettings? with a query string containing 'mailserverport=' followed immediately by SQL injection characters (', ", ;, -, \, *, /) or their URL-encoded equivalents.
  • →The vulnerable endpoint is the addMailServerSettings function, reachable via the admin interface. Both inbound HTTP and TLS-decrypted (SSLDecrypt) traffic should be inspected for exploitation attempts.
  • ·The Snort/Suricata rules require TLS inspection (SSLDecrypt) to detect exploitation over HTTPS. Without TLS decryption deployed, attacks over encrypted channels will not be detected.
  • ·The vulnerability affects Zoho ManageEngine OpManager 12.3 before build 123222 only. Ensure version/build checks are part of asset scoping before deploying detection rules to reduce false positives. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.