Description
SQL injection vulnerability in the AdvanceSearch.class in AdventNetPassTrix.jar in ManageEngine Password Manager Pro (PMP) before 8.1 Build 8101 allows remote authenticated users to execute arbitrary SQL commands via the ANDOR parameter, as demonstrated by a request to STATE_ID/1425543888647/SQLAdvancedALSearchResult.cc.
References
- https://www.manageengine.com/products/passwordmanagerpro/release-notes.html
- http://packetstormsecurity.com/files/132511/ManageEngine-Password-Manager-Pro-8.1-SQL-Injection.html
- 20150630 ManageEngine Password Manager Pro 8.1 SQL Injection vulnerability mailing-list
- 75692 vdb-entry
- 20150703 Re: [##2255763##] ManageEngine Password Manager Pro 8.1 SQL Injection vulnerability mailing-list