CVE-2014-8498

high

Description

SQL injection vulnerability in BulkEditSearchResult.cc in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allows remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter.

References

https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_pmp_privesc.txt

https://exchange.xforce.ibmcloud.com/vulnerabilities/98596

https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-8335

http://www.securityfocus.com/bid/71016

http://www.exploit-db.com/exploits/35210

http://seclists.org/fulldisclosure/2014/Nov/18

http://packetstormsecurity.com/files/129036/Password-Manager-Pro-SQL-Injection.html

http://osvdb.org/show/osvdb/114483

Details

Source: Mitre, NVD

Published: 2014-11-17

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 8.8

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.12745