writeups.xyz / (ZOHO) Manage Engine Desktop Central – SQL Injection / Arbitrary File Write

Submitter : c2a

Date: 2 August 2022

Bounty : undisclosed

Vulnerabilities :

• SQL Injection
• Arbitrary File Write
• Path Traversal

Programs :

• Zoho

Authors :

• Tom Ellson (@Tde_sec)

Link :
https://labs.jumpsec.com/zoho-manage-engine-desktop-central-sql-injection-arbitrary-file-write/