We have been advised during a penetration test that the current version of Applications Manager (12600) is being reported as being vulnerable to SQL injection.

Please verify if this is in fact possible, or if ManageEngine has SQL injection prevention further down the application chain (ie: not via the web interface).

Thanks

-grant