SQL Injection Vulnerabilities in ManageEngine Password Manager Pro
CVE-2014-8499

Currently unrated

Key Information:

Vendor
Manageengine
Status
Password Manager Pro
Vendor
CVE Published:
17 November 2014

Summary

Multiple vulnerabilities exist in ManageEngine Password Manager Pro and its Managed Service Providers edition that permit remote authenticated users to execute arbitrary SQL commands through the SEARCH_ALL parameter. Specifically, these flaws are located in the SQLAdvancedALSearchResult.cc and AdvancedSearchResult.cc files. Exploiting these vulnerabilities can lead to unauthorized access to sensitive data and compromise the integrity of the database.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/98595
vdb-entryx_refsource_XF
http://osvdb.org/show/osvdb/114485
vdb-entryx_refsource_OSVDB
http://osvdb.org/show/osvdb/114484
vdb-entryx_refsource_OSVDB

EPSS Score

77% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.