CVE-2014-8499

Related Files

ManageEngine Password Manager SQLAdvancedALSearchResult.cc Pro SQL Injection

Posted Aug 31, 2024

Authored by Pedro Ribeiro | Site metasploit.com

ManageEngine Password Manager Pro (PMP) has an authenticated blind SQL injection vulnerability in SQLAdvancedALSearchResult.cc that can be abused to escalate privileges and obtain Super Administrator access. A Super Administrator can then use his privileges to dump the whole password database in CSV format. PMP can use both MySQL and PostgreSQL databases but this module only exploits the latter as MySQL does not support stacked queries with Java. PostgreSQL is the default database in v6.8 and above, but older PMP versions can be upgraded and continue using MySQL, so a higher version does not guarantee exploitability. This Metasploit module has been tested on v6.8 to v7.1 build 7104 on both Windows and Linux. The vulnerability is fixed in v7.1 build 7105 and above.

tags | exploit, java, sql injection

systems | linux, windows

advisories | CVE-2014-8499

SHA-256 | 3bb1458e9aceabbc6baaf58c805fc36d04c4e787a9a2a98f33a3d697bff053f3

Download | Favorite | View

Password Manager Pro SQL Injection

Posted Nov 9, 2014

Authored by Pedro Ribeiro

Password Manager Pro versions prior to 7.1 build 7105 suffer from multiple remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, sql injection

advisories | CVE-2014-8498, CVE-2014-8499

SHA-256 | 5f8f9ebe071b8c050eea45fd8ab2cfe66c95dbbe6b9b588dc687571121b75611

Download | Favorite | View