ManageEngine Password Manager Pro 'SEARCH_ALL' Parameter Multiple SQL Injection Vulnerabilities

Bugtraq ID:	71018
Class:	Input Validation Error
CVE:	CVE-2014-8499
Remote:	Yes
Local:	No
Published:	Nov 08 2014 12:00AM
Updated:	Nov 08 2014 12:00AM
Credit:	Pedro Ribeiro
Vulnerable:	ManageEngine Password Manager Pro 7.1 build 7104 ManageEngine Password Manager Pro 7.1 Build 7100 ManageEngine Password Manager Pro 7.0 build 7001 ManageEngine Password Manager Pro 7 build 7003 ManageEngine Password Manager Pro 7 build 7002 ManageEngine Password Manager Pro 6.5 ManageEngine Password Manager Pro 5
Not Vulnerable:	ManageEngine Password Manager Pro 7.1 build 7105

ManageEngine Password Manager Pro 'SEARCH_ALL' Parameter Multiple SQL Injection Vulnerabilities

ManageEngine Password Manager Pro is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit these issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to Password Manager Pro 7.1 build 7105 are vulnerable.

ManageEngine Password Manager Pro 'SEARCH_ALL' Parameter Multiple SQL Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

ManageEngine Password Manager Pro 'SEARCH_ALL' Parameter Multiple SQL Injection Vulnerabilities

References:

• ManageEngine Password Manager Pro -Release Notes PMP Build 7105 (ManageEngine)
  
• Password Manager Pro (ManageEngine)