CVE-2014-3997

HIGH 7.5CVE-2014-3997 · Published 05/12/2014 · updated 17/06/2026

Package	Affected versions	Patched versions
manageengine it360 zohocorp	`≤ 10.3.3`	No fix yet
manageengine password manager pro zohocorp	`= 5.0= 5.1= 5.2= 5.3= 5.4= 6.0= 6.1= 6.2= 6.3= 6.4= 6.5= 6.6= 6.7= 6.8= 6.9= 7.0`	No fix yet

Description

SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition 5 through 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition before 10.3.3 build 10330, and possibly other ManageEngine products, allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the sv parameter to MetadataServlet.dat.

References

seclists.org/fulldisclosure/2014/Aug/55 · Exploit
seclists.org/fulldisclosure/2014/Aug/85 · Exploit
raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_dc_pmp_it360_sqli.txt · Exploit
raw.githubusercontent.com/pedrib/PoC/master/msf_modules/manageengine_dc_pmp_sqli.rb · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free