CVE-2015-7387

ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO." Fixed in Build 11200.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

80.19% chance of exploitation in the next 30 days, 100th percentile

Published

2015-09-28

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://www.rapid7.com/db/modules/exploit/windows/misc/manageengine_eventlog_analyzer_rce

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/manageengine_eventl…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/38352
• https://www.exploit-db.com/exploits/38173

References

• CVE Record
• NVD entry

Related

• CVE-2015-7382
• CVE-2015-7422
• CVE-2015-7381
• CVE-2015-7450
• CVE-2015-7378
• CVE-2015-7497