CVE-2014-8498

SQL injection vulnerability in BulkEditSearchResult.cc in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allows remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 87%
VendorProductVersion
zohocorpmanageengine_password_manager_pro
𝑥
≤ 7.1
zohocorpmanageengine_password_manager_pro
𝑥
≤ 7.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://osvdb.org/show/osvdb/114483
http://packetstormsecurity.com/files/129036/Password-Manager-Pro-SQL-Injection.html
http://seclists.org/fulldisclosure/2014/Nov/18
http://www.exploit-db.com/exploits/35210
http://www.securityfocus.com/bid/71016
https://exchange.xforce.ibmcloud.com/vulnerabilities/98596
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_pmp_privesc.txt
http://osvdb.org/show/osvdb/114483
http://packetstormsecurity.com/files/129036/Password-Manager-Pro-SQL-Injection.html
http://seclists.org/fulldisclosure/2014/Nov/18
http://www.exploit-db.com/exploits/35210
http://www.securityfocus.com/bid/71016
https://exchange.xforce.ibmcloud.com/vulnerabilities/98596
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_pmp_privesc.txt