Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vulnerabilities.

The remote host is running a version of ManageEngine Access Manager Plus prior to 4.3 Build 4305. It is, therefore, affected by a SQL injection vulnerability. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the disclosure or manipulation of arbitrary data.

The remote host is running a version of ManageEngine PAM360 prior to 5.6 Build 5600. It is, therefore, affected by a SQL injection vulnerability. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the disclosure or manipulation of arbitrary data.

The remote host is running a version of ManageEngine Password Manager Pro prior to 12.1 Build 12121. It is, therefore, affected by a SQL injection vulnerability. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the disclosure or manipulation of arbitrary data.

ID	Name	Product	Family	Severity
165348	ManageEngine Access Manager Plus < 4.3 Build 4305 SQLi	Nessus	CGI abuses	critical
165347	ManageEngine PAM360 < 5.6 Build 5600 SQLi	Nessus	CGI abuses	critical
165346	ManageEngine Password Manager Pro < 12.1 Build 12121 SQLi	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2022-40300

critical

Tenable Plugins

critical

critical

critical