Vulnerability Description
Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the (1) OPM_BVNAME parameter in a Delete operation to the APMBVHandler servlet or (2) query parameter in a compare operation to the DataComparisonServlet servlet.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zohocorp | Manageengine Social It Plus | 11.0 |
| Zohocorp | Manageengine Opmanager | 11.3 |
| Zohocorp | Manageengine It360 | 10.3.0 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/129037/ManageEngine-OpManager-Social-IT-PluExploit
- http://seclists.org/fulldisclosure/2014/Nov/21Exploit
- http://www.securityfocus.com/archive/1/533946/100/0/threaded
- http://www.securityfocus.com/bid/71002Exploit
- https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_soExploit
- https://support.zoho.com/portal/manageengine/helpcenter/articles/sql-injection-vExploitPatch
- http://packetstormsecurity.com/files/129037/ManageEngine-OpManager-Social-IT-PluExploit
- http://seclists.org/fulldisclosure/2014/Nov/21Exploit
- http://www.securityfocus.com/archive/1/533946/100/0/threaded
- http://www.securityfocus.com/bid/71002Exploit
- https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_soExploit
- https://support.zoho.com/portal/manageengine/helpcenter/articles/sql-injection-vExploitPatch
FAQ
What is CVE-2014-7868?
CVE-2014-7868 is a vulnerability with a CVSS score of 7.5 (HIGH). Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitr...
How severe is CVE-2014-7868?
CVE-2014-7868 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-7868?
Check the references section above for vendor advisories and patch information. Affected products include: Zohocorp Manageengine Social It Plus, Zohocorp Manageengine Opmanager, Zohocorp Manageengine It360.