Unscored severity · published Dec 4, 2014
CVE-2014-7868
Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated…
–
CVSS
73.3%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the (1) OPM_BVNAME parameter in a Delete operation to the APMBVHandler servlet or (2) query parameter in a compare operation to the DataComparisonServlet servlet.
Exploitation
Is it being used?
Exploit prediction (EPSS)73.3% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Manageengine It360 · Zohocorp
10.3.0; 10.4 · source: NVD
MO
Manageengine Opmanager · Zohocorp
11.3; 11.4 · source: NVD
MS
Manageengine Social IT Plus · Zohocorp
11.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-7868
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-7868
Exploit
http://packetstormsecurity.com/files/129037/ManageEngine-OpManager-Social-IT-Plus-IT360-File-Upload-SQL-Injection.html
Exploit
http://seclists.org/fulldisclosure/2014/Nov/21
www.securityfocus.com
http://www.securityfocus.com/archive/1/533946/100/0/threaded
Exploit
http://www.securityfocus.com/bid/71002
Exploit
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt
Exploit
https://support.zoho.com/portal/manageengine/helpcenter/articles/sql-injection-vulnerability-fix
More from Manageengine It360
7.5
CVE-2014-7863
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and…
–
CVE-2014-7866
Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or…
–
CVE-2014-3997
SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition 5 through 7…
–
CVE-2014-7867
SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and…
–
CVE-2014-6036
Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows…