CVE-2019-11469

CVE-2019-11469 is a critical SQL injection vulnerability affecting Zoho ManageEngine Applications Manager versions 12 through 14. An unauthenticated attacker can exploit this flaw in the FaultTemplateOptions.jsp resourceid parameter to gain SYSTEM-level authority on the server by uploading a malicious file through the "Execute Program Action(s)" feature. With a CVSS score of 9.8, this vulnerability presents a severe risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, a Metasploit module for authentication bypass and remote code execution exists (EDB-46740), indicating public exploit code availability, though community discussion and media coverage remain low.