CVE-2014-3996

50Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendepss 36%

de la publicación al arma0 días

Publicada en NVD5 dic

1ª PoC25 ago

metasploit8 jun

probabilidad de explotación

36%top 2% de las CVE

explotación observada

noninguna fuente lo reporta

2 exploit(s) público(s)

SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90043, Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition before 10.3.3 build 10330, and possibly other ManageEngine products, allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the sv parameter to LinkViewFetchServlet.dat.

Productos afectados

n/a · n/a

PoCs públicas encontradas — 2

cve_referencepacketstormsecurity.com/files/127973/ManageEngine-Password-Manager-MetadataServlet.dat-SQL-Injection.htmlno verificado exploitdbwww.exploit-db.com/exploits/34409no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

Referencias

http://packetstormsecurity.com/files/127973/ManageEngine-Password-Manager-MetadataServlet.dat-SQL-Injection.html http://seclists.org/fulldisclosure/2014/Aug/55 http://seclists.org/fulldisclosure/2014/Aug/85 https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_dc_pmp_it360_sqli.txt https://raw.githubusercontent.com/pedrib/PoC/master/msf_modules/manageengine_dc_pmp_sqli.rb http://www.securityfocus.com/bid/69305