CVE-2014-8499

Description

Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allow remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter to (1) SQLAdvancedALSearchResult.cc or (2) AdvancedSearchResult.cc.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/98597

https://exchange.xforce.ibmcloud.com/vulnerabilities/98595

http://www.securityfocus.com/bid/71018

http://seclists.org/fulldisclosure/2014/Nov/18

http://osvdb.org/show/osvdb/114485

http://osvdb.org/show/osvdb/114484

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3