SQL Injection Vulnerabilities in ManageEngine Password Manager Pro
CVE-2014-8499

Currently unrated

Key Information:

Vendor

Manageengine
Status
Password Manager Pro
Vendor
CVE Published:
17 November 2014

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 74%

What is CVE-2014-8499?

Multiple vulnerabilities exist in ManageEngine Password Manager Pro and its Managed Service Providers edition that permit remote authenticated users to execute arbitrary SQL commands through the SEARCH_ALL parameter. Specifically, these flaws are located in the SQLAdvancedALSearchResult.cc and AdvancedSearchResult.cc files. Exploiting these vulnerabilities can lead to unauthorized access to sensitive data and compromise the integrity of the database.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2014-8499 - Proof of Concept

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/98595
vdb-entryx_refsource_XF
http://osvdb.org/show/osvdb/114485
vdb-entryx_refsource_OSVDB
http://osvdb.org/show/osvdb/114484
vdb-entryx_refsource_OSVDB

EPSS Score

74% chance of being exploited in the next 30 days.

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.