CVE-2014-8499

high

Description

Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allow remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter to (1) SQLAdvancedALSearchResult.cc or (2) AdvancedSearchResult.cc.

References

https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_pmp_privesc.txt

https://exchange.xforce.ibmcloud.com/vulnerabilities/98597

https://exchange.xforce.ibmcloud.com/vulnerabilities/98595

https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-8336

http://www.securityfocus.com/bid/71018

http://www.exploit-db.com/exploits/35210

http://seclists.org/fulldisclosure/2014/Nov/18

http://packetstormsecurity.com/files/129036/Password-Manager-Pro-SQL-Injection.html

http://osvdb.org/show/osvdb/114485

http://osvdb.org/show/osvdb/114484

Details

Source: Mitre, NVD

Published: 2014-11-17

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 8.8

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.36373