Sql injection

2015-02-0416:59:00

PRIOn knowledge base

www.prio-n.com

8.7 High

AI Score

Confidence

Low

0.903 High

EPSS

Percentile

98.8%

JSON

Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the (1) customerName or (2) serverRole parameter in a standbyUpdateInCentral operation to servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.

CPENameOperatorVersion
manageengine_opmanagereq9.0
manageengine_opmanagereq11.5
manageengine_opmanagereq8.8
manageengine_opmanagereq11.3
manageengine_opmanagereq11.4
manageengine_opmanagereq9.4
manageengine_opmanagereq11.0
manageengine_opmanagereq10.2
manageengine_opmanagereq11.1
manageengine_opmanagereq9.1

Name	Operator	Version
manageengine_opmanager	eq	9.0
manageengine_opmanager	eq	11.5
manageengine_opmanager	eq	8.8
manageengine_opmanager	eq	11.3
manageengine_opmanager	eq	11.4
manageengine_opmanager	eq	9.4
manageengine_opmanager	eq	11.0
manageengine_opmanager	eq	10.2
manageengine_opmanager	eq	11.1
manageengine_opmanager	eq	9.1