PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Phân tích CVE-2024-6748

blog.viettelcybersecurity.com | vulnerability | CVE-2024-6748 | #manageengine | #sql-injection | #vulnerability | #opmanager | #cve-2024-6748 | #patch-diff
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Viettel analyzes CVE-2024-6748, a CVSS 8.3 SQL injection in the URL monitoring feature of ManageEngine OpManager, exploitable by authenticated users and patched in build 128318.
CVE
CVE-2024-6748
Published
Collected

Related coverage

vulnerability · blog.viettelcybersecurity.com
CVE-2022-47966 SAML ShowStopper
Viettel dissects CVE-2022-47966: legacy xmlsec in ManageEngine products runs XSLT transforms during SAML signature verification, so a crafted SAMLResponse can trigger unauthenticated RCE.
vulnerability · blog.viettelcybersecurity.com
CVE-2021-38159: MOVEit Transfer SQL Injection Analysis
The author analyzes CVE-2021-38159, a SQL injection in MOVEit Transfer: after fighting trial-license limits, a DLL diff against the patched build pinpoints the unauthenticated injection point.
vulnerability · blog.viettelcybersecurity.com
Zoho ManageEngine Applications Manager: From SQLi to RCE & More
A red team walkthrough of ManageEngine Applications Manager build 13100, showing how its many SQL injection flaws, which carry RCE payloads, can be chained into full system compromise.
vulnerability · blog.quarkslab.com
Snapshotting our way to CVE-2026-9539
This blog post presents a LibAFL-Qemu based way to explore state machines and why we failed to find CVE-2026-9539.
vulnerability · blog.quarkslab.com
MbedTLS Security Audit
At the request of the Open Source Technology Improvement Fund (OSTIF), Quarkslab performed a security audit of mbedTLS, evaluating the security of the changes in version 4.0.
Critical · vulnerability · bishopfox.com
A Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit
The flaw can yield unauthenticated administrator takeover across four AD360-integrated ManageEngine products. Exploitation is targeted and timing-dependent, but the impact is critical.
Back