CVE-2015-7766 PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as d...
HighCVSS 9.0
EPSS 80.6%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT/**/INTO."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Zohocorp ManageEngine OpManager | <= 11.5 | No fix listed |
| Zohocorp ManageEngine OpManager | = 11.6 | No fix listed |
References
- packetstormsecurity.com exploit
- 20150915 ManageEngine OpManager multiple vulnerabilities mailing-list
- www.rapid7.com exploit
- support.zoho.com
- 38221 exploit