CVE-2017-16543 : Security Advisory and Response

Zoho ManageEngine Applications Manager version 13 before build 13500 is vulnerable to SQL injection through the GraphicalView.do function.

Understanding CVE-2017-16543

This CVE involves a security vulnerability in Zoho ManageEngine Applications Manager version 13.

What is CVE-2017-16543?

This CVE identifies a flaw in Zoho ManageEngine Applications Manager version 13 that allows attackers to execute SQL injection attacks by manipulating specific parameters.

The Impact of CVE-2017-16543

The vulnerability in Zoho ManageEngine Applications Manager version 13 can be exploited by attackers to perform SQL injection attacks, potentially leading to unauthorized access to sensitive data or complete system compromise.

Technical Details of CVE-2017-16543

Zoho ManageEngine Applications Manager version 13 before build 13500 is susceptible to SQL injection attacks.

Vulnerability Description

The vulnerability allows attackers to execute SQL injection attacks through the GraphicalView.do function by manipulating the viewProps yCanvas field or the viewid parameter.

Affected Systems and Versions

Product: Zoho ManageEngine Applications Manager
Version: 13 before build 13500

Exploitation Mechanism

Attackers can exploit this vulnerability by crafting malicious input in the viewProps yCanvas field or the viewid parameter to execute SQL injection attacks.

Mitigation and Prevention

It is crucial to take immediate steps to mitigate the risks posed by CVE-2017-16543.

Immediate Steps to Take

Update Zoho ManageEngine Applications Manager to build 13500 or later to patch the vulnerability.
Monitor and restrict user input to prevent malicious SQL injection attempts.

Long-Term Security Practices

Regularly update and patch software to address known vulnerabilities.
Implement input validation and sanitization mechanisms to prevent SQL injection attacks.

Patching and Updates

Ensure that Zoho ManageEngine Applications Manager is regularly updated to the latest version to protect against known vulnerabilities and security threats.