CVE-2014-8499

MEDIUM 6.5CVE-2014-8499 · Published 17/11/2014 · updated 17/06/2026

Package	Affected versions	Patched versions
password manager pro manageengine	`≤ 7.1`	No fix yet

Description

Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allow remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter to (1) SQLAdvancedALSearchResult.cc or (2) AdvancedSearchResult.cc.

References

osvdb.org/show/osvdb/114484
osvdb.org/show/osvdb/114485
packetstormsecurity.com/files/129036/Password-Manager-Pro-SQL-Injection.html · Exploit
seclists.org/fulldisclosure/2014/Nov/18
exploit-db.com/exploits/35210 · Exploit
securityfocus.com/bid/71018
exchange.xforce.ibmcloud.com/vulnerabilities/98595
exchange.xforce.ibmcloud.com/vulnerabilities/98597
raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_pmp_privesc.txt · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free