Description
SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition 5 through 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition before 10.3.3 build 10330, and possibly other ManageEngine products, allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the sv parameter to MetadataServlet.dat.
Exploits (1)
exploitdb
WRITEUP
VERIFIED
by Pedro Ribeiro · textwebappsmultiple
https://www.exploit-db.com/exploits/39288
References (4)
Core 4
Core References
Exploit, Mailing List, Third Party Advisory mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Aug/55
Exploit x_refsource_misc
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_dc_pmp_it360_sqli.txt
Exploit x_refsource_misc
https://raw.githubusercontent.com/pedrib/PoC/master/msf_modules/manageengine_dc_pmp_sqli.rb
Exploit, Mailing List, Third Party Advisory mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Aug/85
Scores
EPSS
0.0129
EPSS Percentile
79.8%
Details
CWE
CWE-89
Status
published
Products (17)
zohocorp/manageengine_it360
< 10.3.3 (2 CPE variants)
zohocorp/manageengine_password_manager_pro
5.0 (2 CPE variants)
zohocorp/manageengine_password_manager_pro
5.1 (2 CPE variants)
zohocorp/manageengine_password_manager_pro
5.2 (2 CPE variants)
zohocorp/manageengine_password_manager_pro
5.3 (2 CPE variants)
zohocorp/manageengine_password_manager_pro
5.4 (2 CPE variants)
zohocorp/manageengine_password_manager_pro
6.0 (4 CPE variants)
zohocorp/manageengine_password_manager_pro
6.1 build6104 (3 CPE variants)
zohocorp/manageengine_password_manager_pro
6.2 (3 CPE variants)
zohocorp/manageengine_password_manager_pro
6.3
... and 7 more
Published
Dec 05, 2014
Tracked Since
Feb 18, 2026