CVE-2015-5150

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine SupportCenter Plus version 7.90

Description The issue allows remote authenticated users to inject arbitrary web script or HTML. This can be achieved via the query parameter in the "run query editor query" module to "CustomReportHandler.do", the compAcct parameter to "jsp/ResetADPwd.jsp", or the redirectTo parameter to "jsp/CacheScreenWidth.jsp".

Recommendations For Zoho ManageEngine SupportCenter Plus version 7.90, consider disabling access to the "run query editor query" module, restricting the use of the compAcct parameter in "jsp/ResetADPwd.jsp", and limiting access to the redirectTo parameter in "jsp/CacheScreenWidth.jsp" until a patch is available.