ManageEngine Password Manager Pro < Build 13235 SQLi (CVE-2026-14828)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(342631);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/03");

  script_cve_id("CVE-2026-14828");

  script_name(english:"ManageEngine Password Manager Pro < Build 13235 SQLi (CVE-2026-14828)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is running a web application affected by a SQL injection vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported build number, the ManageEngine Password Manager Pro application running on the remote
host is prior to build 13235. It is, therefore, affected by an authenticated SQL injection vulnerability. An
authenticated, remote attacker can exploit this by crafting a malicious query to execute unintended SQL operations on
the back-end database, resulting in the disclosure or manipulation of arbitrary data.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported build
number.");
  # https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2026-14828.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bdff91f4");
  script_set_attribute(attribute:"solution", value:
"Upgrade to ManageEngine Password Manager Pro build 13235 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-14828");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/03");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:zohocorp:manageengine_password_manager_pro");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("manageengine_pmp_detect.nbin");
  script_require_keys("installed_sw/ManageEngine Password Manager Pro");
  script_require_ports("Services/www", 7272);

  exit(0);
}

include('vcf.inc');
include('vcf_extras_zoho.inc');
include('http.inc');

var appname = 'ManageEngine Password Manager Pro';

var port    = get_http_port(default:7272, embedded:TRUE);

var app_info = vcf::zoho::fix_parse::get_app_info(app:appname, port:port);

var constraints = [
  { 'fixed_version' : '13235', 'fixed_display' : 'Build 13235' }
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE,
  flags:{'sqli':TRUE}
);