Main Vulnerability Database Vulnerabilities #VU113365

PHP file inclusion in Zoho ManageEngine ServiceDesk Plus MSP and Zoho ManageEngine SupportCenter Plus - CVE-2025-3444

Published: July 28, 2025

Vulnerability identifier: #VU113365

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-3444

CWE-ID: CWE-98

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to include and execute arbitrary PHP files on the server.

The vulnerability exists due to incorrect input validation when including PHP files in the Admin module. A remote authenticated user can send a specially crafted HTTP request to the affected application, include and execute arbitrary PHP code on the system with privileges of the web server.

Affected software

Zoho ManageEngine ServiceDesk Plus MSP
Zoho ManageEngine SupportCenter Plus

How to mitigate CVE-2025-3444

Install updates from vendor's website.

Zoho ManageEngine ServiceDesk Plus MSP - update to 14920
Zoho ManageEngine SupportCenter Plus - update to 14920

External References

https://www.manageengine.com/products/service-desk-msp/cve-2025-3444.html

Related Security Bulletins