CVE-2019-15104

published 2019-08-16

CVE-2019-15104: An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the…

Priority P2 66 high 8.8 CVSS 3.0

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious file using the "Execute Program Action(s)" feature.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
zohocorp	manageengine_applications_manager	12.0 – 14.0	—

Detection & IOCs extracted from sources · hover to see the quote

url /jsp/NewThresholdConfiguration.jsp↗

path /jsp/NewThresholdConfiguration.jsp↗

port 8060↗

cookie JSESSIONID_APM_↗

• → Detect SQL injection attempts against the resourceid parameter of NewThresholdConfiguration.jsp; payloads will contain CHAR() sequences used to encode strings for MSSQL/PostgreSQL injection. ↗
• → Monitor POST requests to /Upload.do on OpManager for multipart file uploads containing executable payloads (.bat, .sh, .pl, .py, .rb); successful upload returns 'icon_message_success' in the response body. ↗
• → Monitor POST requests to /adminAction.do with method=createExecProgAction, which registers the uploaded malicious file as an executable program action. ↗
• → A low-privilege user account suddenly gaining SYSTEM-level authority on the OpManager server is a key post-exploitation indicator; watch for new admin account creation via SQLi followed by login from the same session. ↗
• → Detect the exploit check phase: GET requests to /apiclient/ember/Login.jsp that receive a 200 response containing 'Logout.do?showPreLogin=false' indicate the target is being fingerprinted as vulnerable. ↗

• · The exploit targets OpManager v12.4.034 and prior versions only; the default attack port is 8060 but may vary in non-default deployments. ↗
• · The exploit requires a valid low-privilege OpManager username and password as a prerequisite; unauthenticated exploitation is not supported by this module. ↗
• · The Application Manager Plugin must be present and accessible for the file upload and Execute Program Action feature to be exploitable. ↗

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89