CVE:CVE-2019-11678
CNNVD:CNNVD-201905-074
ZOHO ManageEngine Firewall Analyzer是美国卓豪（ZOHO）公司的一套基于Web的防火墙日志分析工具，它能收集、关联分析和汇报整个企业范围内的防火墙、proxy伺服器和Radius伺服器上的日志。
ZOHO ManageEngine Firewall Analyzer 12.3 Build 123218之前版本中存在SQL注入漏洞。该漏洞源于基于数据库的应用缺少对外部输入SQL语句的验证。攻击者可利用该漏洞执行非法SQL命令。
solution:Upgrade zohocorp manageengine_firewall_analyzer to a higher version than 7.2:7020,7.2:7021,7.4:7400,7.6:7600,8.0:8000,8.1:8110,8.3:8300,8.5:8500,12.0:12000,12.2:12200,12.3:12300,12.3:123008,12.3:123027,12.3:123045,12.3:123057,12.3:123064,12.3:123070,12.3:123083,12.3:123092,12.3:123126,12.3:123129,12.3:123137,12.3:123151,12.3:123156,12.3:123164,12.3:123169,12.3:123177,12.3:123182,12.3:123185,12.3:123186,12.3:123194,12.3:123197,12.3:123208,and avoid the version 7.2:7020,7.2:7021,7.4:7400,7.6:7600,8.0:8000,8.1:8110,8.3:8300,8.5:8500,12.0:12000,12.2:12200,12.3:12300,12.3:123008,12.3:123027,12.3:123045,12.3:123057,12.3:123064,12.3:123070,12.3:123083,12.3:123092,12.3:123126,12.3:123129,12.3:123137,12.3:123151,12.3:123156,12.3:123164,12.3:123169,12.3:123177,12.3:123182,12.3:123185,12.3:123186,12.3:123194,12.3:123197,12.3:123208