Back to feed
EUVD-2015-5415 · Published Jul 8, 2015
SQL injection vulnerability in the AdvanceSearch.class in AdventNetPassTrix.jar in ManageEngine Password Manager Pro (PMP) before 8.1 Build 8101 allows remote authenticated users to execute arbitrary SQL commands via the ANDOR parameter, as demonstrated by a request to STATE_ID/1425543888647/SQLAdvancedALSearchResult.cc.
Technologies
Zohocorp Manageengine Password Manager Pro
Weaknesses
CWE-89
CVSS scores
- v2.06.5
AV:N/AC:L/Au:S/C:P/I:P/A:P
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
- http://packetstormsecurity.com/files/132511/ManageEngine-Password-Manager-Pro-8.1-SQL-Injection.html
- http://seclists.org/fulldisclosure/2015/Jun/104
- http://seclists.org/fulldisclosure/2015/Jul/19
- http://www.securityfocus.com/bid/75692
- https://www.manageengine.com/products/passwordmanagerpro/release-notes.html
Potentially impacted assets
See if this affects your attack surface
