CVE-2014-8498

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in BulkEditSearchResult.cc in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allows remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/show/osvdb/114483Broken Link
http://packetstormsecurity.com/files/129036/Password-Manager-Pro-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2014/Nov/18Exploit, Mailing List, Third Party Advisory
http://www.exploit-db.com/exploits/35210Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/71016Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/98596VDB Entry
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_pmp_privesc.txtExploit
http://osvdb.org/show/osvdb/114483Broken Link
http://packetstormsecurity.com/files/129036/Password-Manager-Pro-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2014/Nov/18Exploit, Mailing List, Third Party Advisory
http://www.exploit-db.com/exploits/35210Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/71016Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/98596VDB Entry
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_pmp_privesc.txtExploit

Timeline

Published: Nov 17, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-84996.5Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) e CVE-2014-85007.8ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 does not limit delegation chaining, which allows remote attacke CVE-2014-85017.5The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of servic CVE-2014-85027.5Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to caus CVE-2014-85037.5Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attackers to cause a deni CVE-2014-85047.5Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attackers to cause a deni CVE-2014-85054.3Multiple cross-site scripting (XSS) vulnerabilities in Etiko CMS allow remote attackers to inject arbitrary web script or HTML via the (1) p CVE-2014-85067.5Multiple SQL injection vulnerabilities in Etiko CMS allow remote attackers to execute arbitrary SQL commands via the (1) page_id parameter t CVE-2014-85077.5Multiple SQL injection vulnerabilities in the queryLastApp method in packages/WAPPushManager/src/com/android/smspush/WapPushManager.java in CVE-2014-85084.3Cross-site scripting (XSS) vulnerability in s_network.asp in the Denon AVR-3313CI audio/video receiver allows remote attackers to inject arb CVE-2014-85097.5The lazy_bdecode function in BitTorrent bootstrap-dht (aka Bootstrap) allows remote attackers to execute arbitrary code via a crafted packet CVE-2014-85104.0The AdminUI in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) before 6.0 HF build 1244 allows remote authenticated users to re