CVE

Id
84664  
CVE No.
CVE-2015-7387  
Status
Candidate  
Description
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO."  
Phase
Assigned (20150928)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
749447 84664 CVE-2015-7387 EXPLOIT-DB:38173  View
749448 84664 CVE-2015-7387 URL:https://www.exploit-db.com/exploits/38173/  View
749449 84664 CVE-2015-7387 EXPLOIT-DB:38352  View
749450 84664 CVE-2015-7387 URL:https://www.exploit-db.com/exploits/38352/  View
749451 84664 CVE-2015-7387 FULLDISC:20150915 ManageEngine EventLog Analyzer SQL query execution  View
749452 84664 CVE-2015-7387 URL:http://seclists.org/fulldisclosure/2015/Sep/59  View
749453 84664 CVE-2015-7387 MISC:http://packetstormsecurity.com/files/133581/ManageEngine-EventLog-Analyzer-10.6-Build-10060-SQL-Query-Execution.html  View
749454 84664 CVE-2015-7387 MISC:http://packetstormsecurity.com/files/133747/ManageEngine-EventLog-Analyzer-Remote-Code-Execution.html  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
11535 JVNDB-2015-006855 複数の IBM Rational Software Architect 製品で配布される InfoSphere Data Architect におけるクロスサイトスクリプティングの脆弱性 IBM Rational Software Architect、Rational Software Architect for WebSphere Software (RSA4WS)、および Rational Software Architect RealTime (RSART) で配布される InfoSphere Data Architect (IDA) には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2015-7439 84664 4.3 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-006855.html  View