QwikSec

Security Database

CVE

CWE

Training

CVE-2015-7387

Published: Sep 28, 2015

Modified: Aug 6, 2024

PUBLISHED

Description

ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO." Fixed in Build 11200.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

exploit

x_refsource_EXPLOIT-DB

20150915 ManageEngine EventLog Analyzer SQL query execution

mailing-list

x_refsource_FULLDISC

exploit

x_refsource_EXPLOIT-DB

http://packetstormsecurity.com/files/133581/ManageEngine-EventLog-Analyzer-10.6-Build-10060-SQL-Query-Execution.html

x_refsource_MISC

http://packetstormsecurity.com/files/133747/ManageEngine-EventLog-Analyzer-Remote-Code-Execution.html

x_refsource_MISC

http://www.rapid7.com/db/modules/exploit/windows/misc/manageengine_eventlog_analyzer_rce

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.