CVE-2015-7387
ManageEngine EventLog Analyzer < 10.6 - SQL Injection via event/runQuery.do Query Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2015-7387.
PoCs published by Metasploit, xistence, including Metasploit module exploits/windows/misc/manageengine_eventlog_analyzer_rce.
AI-analyzed exploit summary This Metasploit module exploits a SQL injection vulnerability in ManageEngine EventLog Analyzer, allowing authenticated users to execute arbitrary SQL queries as the 'postgres' user. It uploads a malicious JSP payload to achieve remote code execution with SYSTEM privileges.
Description
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO." Fixed in Build 11200.
Exploits (3)
This Metasploit module exploits a SQL injection vulnerability in ManageEngine EventLog Analyzer, allowing authenticated users to execute arbitrary SQL queries as the 'postgres' user. It uploads a malicious JSP payload to achieve remote code execution with SYSTEM privileges.
This writeup describes an authenticated SQL injection vulnerability in ManageEngine EventLog Analyzer v10.6 build 10060 and earlier. The vulnerability allows SQL query execution via the '/event/runQuery.do' endpoint, including bypassing restrictions on INSERT/UPDATE queries by chaining them with SELECT statements.
This Metasploit module exploits a SQL injection vulnerability in ManageEngine EventLog Analyzer, allowing authenticated users to execute arbitrary SQL queries as the 'postgres' user. It uploads a malicious JSP payload to achieve remote code execution with SYSTEM privileges.