CVE-2015-7387
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 80.2%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO." Fixed in Build 11200.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 80.19% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- zohocorp/manageengine eventlog analyzer
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/133581/ManageEngine-EventLog-Analyzer-10.6-Build-10060-SQL-Query-Execution.htmlExploit
- http://packetstormsecurity.com/files/133747/ManageEngine-EventLog-Analyzer-Remote-Code-Execution.htmlExploit
- http://seclists.org/fulldisclosure/2015/Sep/59Exploit
- http://www.rapid7.com/db/modules/exploit/windows/misc/manageengine_eventlog_analyzer_rce
- https://www.exploit-db.com/exploits/38173/Exploit
- https://www.exploit-db.com/exploits/38352/Exploit
- http://packetstormsecurity.com/files/133581/ManageEngine-EventLog-Analyzer-10.6-Build-10060-SQL-Query-Execution.htmlExploit
- http://packetstormsecurity.com/files/133747/ManageEngine-EventLog-Analyzer-Remote-Code-Execution.htmlExploit
- http://seclists.org/fulldisclosure/2015/Sep/59Exploit
- http://www.rapid7.com/db/modules/exploit/windows/misc/manageengine_eventlog_analyzer_rce
- https://www.exploit-db.com/exploits/38173/Exploit
- https://www.exploit-db.com/exploits/38352/Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.