CVE-2015-7387
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
60Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendepss 80%
de la publicación al armael mismo día
Publicada en NVD28 sept
1ª PoC14 sept
metasploit11 jul
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO." Fixed in Build 11200.
Productos afectados
n/a · n/aPoCs públicas encontradas — 6✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/38352exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/38173cve_referencepacketstormsecurity.com/files/133581/ManageEngine-EventLog-Analyzer-10.6-Build-10060-SQL-Query-Execution.htmlno verificadocve_referencewww.exploit-db.com/exploits/38352/no verificadocve_referencepacketstormsecurity.com/files/133747/ManageEngine-EventLog-Analyzer-Remote-Code-Execution.htmlno verificadocve_referencewww.exploit-db.com/exploits/38173/no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
http://packetstormsecurity.com/files/133581/ManageEngine-EventLog-Analyzer-10.6-Build-10060-SQL-Query-Execution.htmlhttp://packetstormsecurity.com/files/133747/ManageEngine-EventLog-Analyzer-Remote-Code-Execution.htmlhttp://seclists.org/fulldisclosure/2015/Sep/59https://www.exploit-db.com/exploits/38173/https://www.exploit-db.com/exploits/38352/http://www.rapid7.com/db/modules/exploit/windows/misc/manageengine_eventlog_analyzer_rce