Vulnerability Details : CVE-2014-8498
SQL injection vulnerability in BulkEditSearchResult.cc in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allows remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter.
Vulnerability category: Sql Injection
Exploit prediction scoring system (EPSS) score for CVE-2014-8498
Probability of exploitation activity in the next 30 days: 1.42%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 85 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2014-8498
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST |
CWE ids for CVE-2014-8498
-
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-8498
-
http://seclists.org/fulldisclosure/2014/Nov/18
Full Disclosure: [The ManageOwnage Series, part VII]: Super admin privesc + password DB dump in Password Manager ProExploit;Mailing List;Third Party Advisory
-
http://www.securityfocus.com/bid/71016
ManageEngine Password Manager Pro 'BulkEditSearchResult.cc' SQL Injection VulnerabilityThird Party Advisory;VDB Entry
-
http://www.exploit-db.com/exploits/35210
Password Manager Pro / Pro MSP - Blind SQL Injection - Multiple webapps ExploitExploit;Third Party Advisory;VDB Entry
-
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_pmp_privesc.txt
Exploit
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/98596
ManageEngine Password Manager Pro BulkEditSearchResult.cc SQL injection CVE-2014-8498 Vulnerability ReportVDB Entry
-
http://packetstormsecurity.com/files/129036/Password-Manager-Pro-SQL-Injection.html
Password Manager Pro SQL Injection ≈ Packet StormExploit;Third Party Advisory;VDB Entry
Products affected by CVE-2014-8498
- Zohocorp » Manageengine Password Manager Pro » Managed Service Providers EditionVersions up to, including, (<=) 7.1cpe:2.3:a:zohocorp:manageengine_password_manager_pro:*:*:*:*:managed_service_providers:*:*:*
- cpe:2.3:a:zohocorp:manageengine_password_manager_pro:*:*:*:*:-:*:*:*