Multiple ManageEngine Products CVE-2014-7868 Multiple SQL Injection Vulnerabilities
BID:71002
Info
Multiple ManageEngine Products CVE-2014-7868 Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 71002 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-7868 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 10 2014 12:00AM |
| Updated: | May 12 2015 07:35PM |
| Credit: | Pedro Ribeiro, Agile Information Security |
| Vulnerable: |
ZOHO Corporation ManageEngine Social IT Plus 11.0 ZOHO Corporation ManageEngine OpManager 11.4 ZOHO Corporation ManageEngine OpManager 11.3 ZOHO Corporation ManageEngine IT360 10.4 ZOHO Corporation ManageEngine IT360 10.3 |
| Not Vulnerable: | |
Discussion
Multiple ManageEngine Products CVE-2014-7868 Multiple SQL Injection Vulnerabilities
Multiple ManageEngine Products are prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
Multiple ManageEngine Products are prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
Exploit / POC
Multiple ManageEngine Products CVE-2014-7868 Multiple SQL Injection Vulnerabilities
Attackers can use a browser to exploit these issues.
The following example input's are available:
POST /servlet/APMBVHandler?OPERATION_TYPE=Delete&OPM_BVNAME=[SQLi]
POST /servlet/DataComparisonServlet?operation=compare&numPrimaryKey=1337&query=[SQLi]
Attackers can use a browser to exploit these issues.
The following example input's are available:
POST /servlet/APMBVHandler?OPERATION_TYPE=Delete&OPM_BVNAME=[SQLi]
POST /servlet/DataComparisonServlet?operation=compare&numPrimaryKey=1337&query=[SQLi]
Solution / Fix
Multiple ManageEngine Products CVE-2014-7868 Multiple SQL Injection Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Multiple ManageEngine Products CVE-2014-7868 Multiple SQL Injection Vulnerabilities
References:
References:
- OpManager Homepage (ManageEngine)