CVE-2014-7868
ManageEngine OpManager 11.3-11.4, IT360 10.3-10.4, Social IT Plus 11.0 SQL Injection
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2014-7868. PoCs published by Pedro Ribeiro.
AI-analyzed exploit summary The document describes multiple vulnerabilities in ManageEngine OpManager, Social IT Plus, and IT360, including unauthenticated remote code execution via file upload (CVE-2014-7866) and blind SQL injection (CVE-2014-7868). It provides technical details, affected versions, and mitigation steps.
Description
Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the (1) OPM_BVNAME parameter in a Delete operation to the APMBVHandler servlet or (2) query parameter in a compare operation to the DataComparisonServlet servlet.
Exploits (2)
The document describes multiple vulnerabilities in ManageEngine OpManager, Social IT Plus, and IT360, including unauthenticated remote code execution via file upload (CVE-2014-7866) and blind SQL injection (CVE-2014-7868). It provides technical details, affected versions, and mitigation steps.
This is a detailed writeup describing multiple vulnerabilities in ManageEngine OpManager, Social IT Plus, and IT360, including remote code execution, arbitrary file deletion, and blind SQL injection. It provides technical details, affected versions, and mitigation steps but does not include actual exploit code.