NVD

Id
35150  
Name
CVE-2014-7868  
Description
Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the (1) OPM_BVNAME parameter in a Delete operation to the APMBVHandler servlet or (2) query parameter in a compare operation to the DataComparisonServlet servlet.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-12-04  
Modified Date
2015-09-29  
Seq
2014-7868  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
179919 35150 CVE-2014-7868 http://packetstormsecurity.com/files/129037/ManageEngine-OpManager-Social-IT-Plus-IT360-File-Upload-SQL-Injection.html  View
179920 35150 CVE-2014-7868 20141109 [The ManageOwnage series, part VIII]: Remote code execution and blind SQLi in OpManager, Social IT and IT360  View
179921 35150 CVE-2014-7868 20141109 [The ManageOwnage series, part VIII]: Remote code execution and blind SQLi in OpManager, Social IT and IT360  View
179922 35150 CVE-2014-7868 71002  View
179923 35150 CVE-2014-7868 https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt  View
179924 35150 CVE-2014-7868 https://support.zoho.com/portal/manageengine/helpcenter/articles/sql-injection-vulnerability-fix  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
16897 JVNDB-2014-005772 複数の ZOHO 製品における SQL インジェクションの脆弱性 ZOHO ManageEngine OpManager、IT360、および Social IT Plus には、SQL インジェクションの脆弱性が存在します。 CVE-2014-7868 75161 CVE-2014-7868 35150 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005772.html 2014-11-09 2014-12-05 View