CVEvulnerability
CVE-2015-5459
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-07-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
SQL injection vulnerability in the AdvanceSearch.class in AdventNetPassTrix.jar in ManageEngine Password Manager Pro (PMP) before 8.1 Build 8101 allows remote authenticated users to execute arbitrary SQL commands via the ANDOR parameter, as demonstrated by a request to STATE_ID/1425543888647/SQLAdvancedALSearchResult.cc.
Affected configurations
• zohocorp manageengine password manager pro (<= 8.1)
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://packetstormsecurity.com/files/132511/ManageEngine-Password-Manager-Pro-8.1-SQL-Injection.html Exploit
- http://seclists.org/fulldisclosure/2015/Jul/19 seclists.org
- http://seclists.org/fulldisclosure/2015/Jun/104 Exploit
- http://www.securityfocus.com/bid/75692 www.securityfocus.com
- https://www.manageengine.com/products/passwordmanagerpro/release-notes.html Patch, Vendor Advisory
- http://packetstormsecurity.com/files/132511/ManageEngine-Password-Manager-Pro-8.1-SQL-Injection.html Exploit
- http://seclists.org/fulldisclosure/2015/Jul/19 seclists.org
- http://seclists.org/fulldisclosure/2015/Jun/104 Exploit
- http://www.securityfocus.com/bid/75692 www.securityfocus.com
- https://www.manageengine.com/products/passwordmanagerpro/release-notes.html Patch, Vendor Advisory