Unscored severity · published Nov 17, 2014
CVE-2014-8499
Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allow…
–
CVSS
36.4%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allow remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter to (1) SQLAdvancedALSearchResult.cc or (2) AdvancedSearchResult.cc.
Exploitation
Is it being used?
Exploit prediction (EPSS)36.4% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PM
Password Manager Pro · Manageengine
through 7.1; through 7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8499
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8499
osvdb.org
http://osvdb.org/show/osvdb/114484
osvdb.org
http://osvdb.org/show/osvdb/114485
Exploit
http://packetstormsecurity.com/files/129036/Password-Manager-Pro-SQL-Injection.html
seclists.org
http://seclists.org/fulldisclosure/2014/Nov/18
Exploit
http://www.exploit-db.com/exploits/35210
www.securityfocus.com
http://www.securityfocus.com/bid/71018
More from Password Manager Pro
8.8
CVE-2024-5546
SQL Injection
–
CVE-2014-9372
Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro (PMP) before 7103 allows remote attackers to delete arbitrary files…
–
CVE-2014-3996
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build…
–
CVE-2009-4387
The cross-site scripting (XSS) protection mechanism in ShowInContentAreaAction.do in ManageEngine Password Manager Pro (PMP) before 6.1 Build 6104 uses case-sensitive checks for…