ManageEngine Applications Manager is prone to a remote code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary code in the context of the affected system. Failed exploit attempts may result in a denial-of-service condition.
Information
Exploit
The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.
References:
- Adding ManageEngine Application Manager RCE (Mehmet INCE)
- Advisory | ManageEngine Applications Manager Remote Code Execution and SQLi (Mehmet Ince)
- ManageEngine Applications Manager Homepage (ManageEngine)