CVE-2019-15104

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious file using the "Execute Program Action(s)" feature.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://pentest.com.tr/exploits/DEFCON-ManageEngine-OpManager-v12-4-Privilege-Escalation-Remote-Command-Execution.htmlExploit, Third Party Advisory
https://www.exploit-db.com/exploits/47227Exploit, Third Party Advisory, VDB Entry
https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-15104.htmlVendor Advisory
http://pentest.com.tr/exploits/DEFCON-ManageEngine-OpManager-v12-4-Privilege-Escalation-Remote-Command-Execution.htmlExploit, Third Party Advisory
https://www.exploit-db.com/exploits/47227Exploit, Third Party Advisory, VDB Entry
https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-15104.htmlVendor Advisory

Timeline

Published: Aug 16, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-151058.8An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdCon CVE-2019-151069.8An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute comm CVE-2019-151079.8An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.CVE-2019-151084.8An issue was discovered in WSO2 API Manager 2.6.0 before WSO2-CARBON-PATCH-4.4.0-4457. There is XSS via a crafted filename to the file-uploa CVE-2019-151096.1The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.CVE-2019-151106.1The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.CVE-2019-151119.8The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.CVE-2019-151126.1The wp-slimstat plugin before 4.8.1 for WordPress has XSS.CVE-2019-151138.8The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.CVE-2019-151148.8The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.CVE-2019-151158.8The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.CVE-2019-151166.1The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.