Evil-DB LogoEvil-DB
← All CVEs

CVE-2014-7864

high · 7.5

Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the (1) customerName or (2) serverRole parameter in a standbyUpdateInCentral operation to servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.

7.5
CVSS
22.7%
EPSS (exploit prob.)
98th
EPSS percentile
2015-02-04
Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-89

Affected products

VendorProductAffected versions
zohocorpmanageengine_opmanager8.8
zohocorpmanageengine_opmanager9.0
zohocorpmanageengine_opmanager9.1
zohocorpmanageengine_opmanager9.2
zohocorpmanageengine_opmanager9.4
zohocorpmanageengine_opmanager10.0
zohocorpmanageengine_opmanager10.1
zohocorpmanageengine_opmanager10.2
zohocorpmanageengine_opmanager11.0
zohocorpmanageengine_opmanager11.1
zohocorpmanageengine_opmanager11.2
zohocorpmanageengine_opmanager11.3
zohocorpmanageengine_opmanager11.4
zohocorpmanageengine_opmanager11.5

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-7864