CVE-2015-7766

PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT/**/INTO."

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

80.64% chance of exploitation in the next 30 days, 100th percentile

Published

2015-10-09

Updated

2024-09-17

Proof-of-concept exploits (1)

• http://www.rapid7.com/db/modules/exploit/windows/http/manage_engine_opmanager_rce

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manage_engine_opman…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/38221

References

• CVE Record
• NVD entry

Related

• CVE-2015-7765
• CVE-2015-7767
• CVE-2015-7755
• CVE-2015-7768
• CVE-2015-7744
• CVE-2015-7780