Multiple vulnerabilities have been reported in ManageEngine SupportCenter Plus, which can be exploited by malicious users to disclose potentially sensitive information, bypass certain security restrictions, and conduct script insertion and SQL injection attacks and by malicious people to conduct script insertion attacks.

1) Input passed via the "countSql" POST parameter to servlet/AJaxServlet (when "action" is set to "getWorkOrderCount") is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) Input passed via the "userName", "description", and "emailID" POST parameters to sd/Request.sd when submitting a ticket is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

3) Input passed via the "fullName", "twitterId", and "jobTitle" parameters to RequesterDef.do when editing a contact is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

4) Input passed via the "description" POST parameter to WorkOrder.do when creating a request is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

5) Input passed to the "backup_ids" parameter in BackupSchedule.do (when "module" is set to "delete_backup") is not properly verified before being used. This can be exploited to delete backup files.

6) The application allows database backup requests via BackupSchedule.do without checking credentials. This can be exploited to create a backup in a publicly accessible folder and disclose sensitive information.

The vulnerabilities are reported in version 7.9 build 7903. Other versions may also be affected.

Solution
Update to version 7.9 build 7905.

Provided and/or discovered by
Robert van Hamburg

Original Advisory
ManageEngine:
https://supportcenter.wiki.zoho.com/ReadMe-V2.html#7905

Robert van Hamburg:
http://www.exploit-db.com/exploits/18745/

Deep Links
Links available to Secunia VIM customers