CVE-2015-5459: SQL Injection
First published: Wed Jul 08 2015(Updated: )
SQL injection vulnerability in the AdvanceSearch.class in AdventNetPassTrix.jar in ManageEngine Password Manager Pro (PMP) before 8.1 Build 8101 allows remote authenticated users to execute arbitrary SQL commands via the ANDOR parameter, as demonstrated by a request to STATE_ID/1425543888647/SQLAdvancedALSearchResult.cc.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zohocorp Manageengine Password Manager Pro | <=8.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/132511/ManageEngine-Password-Manager-Pro-8.1-SQL-Injection.html
- http://seclists.org/fulldisclosure/2015/Jul/19
- http://seclists.org/fulldisclosure/2015/Jun/104
- http://www.securityfocus.com/bid/75692
- https://www.manageengine.com/products/passwordmanagerpro/release-notes.html
Frequently Asked Questions
What is the severity of CVE-2015-5459?
CVE-2015-5459 is classified as a medium severity SQL injection vulnerability.
How do I fix CVE-2015-5459?
To fix CVE-2015-5459, upgrade ManageEngine Password Manager Pro to version 8.1 Build 8101 or later.
Who is affected by CVE-2015-5459?
CVE-2015-5459 affects ManageEngine Password Manager Pro versions prior to 8.1 Build 8101.
What type of vulnerability is CVE-2015-5459?
CVE-2015-5459 is an SQL injection vulnerability that allows execution of arbitrary SQL commands.
Can CVE-2015-5459 be exploited remotely?
Yes, CVE-2015-5459 can be exploited remotely by authenticated users to execute SQL commands.
- collector/nvd-index
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/tags
- agent/remedy
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- vendor/zohocorp
- canonical/zohocorp manageengine password manager pro
- version/zohocorp manageengine password manager pro/8.1