CVE-2014-3997

ManageEngine Password Manager Pro 5-7 build 7003 - SQL Injection via MetadataServlet sv Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-3997. PoCs published by Pedro Ribeiro.

AI-analyzed exploit summary This is a detailed writeup describing blind SQL injection vulnerabilities in ManageEngine Password Manager Pro and IT360. It includes affected versions, constraints, and proof-of-concept URLs but does not contain executable exploit code.

Description

SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition 5 through 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition before 10.3.3 build 10330, and possibly other ManageEngine products, allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the sv parameter to MetadataServlet.dat.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Pedro Ribeiro · textwebappsmultiple
https://www.exploit-db.com/exploits/39288

This is a detailed writeup describing blind SQL injection vulnerabilities in ManageEngine Password Manager Pro and IT360. It includes affected versions, constraints, and proof-of-concept URLs but does not contain executable exploit code.

Classification
Writeup 100%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: ManageEngine Password Manager Pro (v5 to v7 build 7002), ManageEngine IT360 (v8 to v10.1.1 build 10110)
No auth needed
Prerequisites: Network access to the target application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Aug/55
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Aug/85

Scores

EPSS 0.0920
EPSS Percentile 94.7%

Details

CWE
CWE-89
Status published
Products (17)
zohocorp/manageengine_it360 < 10.3.3 (2 CPE variants)
zohocorp/manageengine_password_manager_pro 5.0 (2 CPE variants)
zohocorp/manageengine_password_manager_pro 5.1 (2 CPE variants)
zohocorp/manageengine_password_manager_pro 5.2 (2 CPE variants)
zohocorp/manageengine_password_manager_pro 5.3 (2 CPE variants)
zohocorp/manageengine_password_manager_pro 5.4 (2 CPE variants)
zohocorp/manageengine_password_manager_pro 6.0 (4 CPE variants)
zohocorp/manageengine_password_manager_pro 6.1 build6104 (3 CPE variants)
zohocorp/manageengine_password_manager_pro 6.2 (3 CPE variants)
zohocorp/manageengine_password_manager_pro 6.3
... and 7 more
Published Dec 05, 2014
Tracked Since Feb 18, 2026