Vulnerabilities > CVE-2014-8499 - SQL Injection vulnerability in Manageengine Password Manager PRO

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
SINGLE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
manageengine
CWE-89
nessus
exploit available
metasploit

Summary

Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allow remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter to (1) SQLAdvancedALSearchResult.cc or (2) AdvancedSearchResult.cc.

Vulnerable Configurations

Part Description Count
Application
Manageengine
2

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Command Line Execution through SQL Injection
    An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
  • Object Relational Mapping Injection
    An attacker leverages a weakness present in the database access layer code generated with an Object Relational Mapping (ORM) tool or a weakness in the way that a developer used a persistence framework to inject his or her own SQL commands to be executed against the underlying database. The attack here is similar to plain SQL injection, except that the application does not use JDBC to directly talk to the database, but instead it uses a data access layer generated by an ORM tool or framework (e.g. Hibernate). While most of the time code generated by an ORM tool contains safe access methods that are immune to SQL injection, sometimes either due to some weakness in the generated code or due to the fact that the developer failed to use the generated access methods properly, SQL injection is still possible.
  • SQL Injection through SOAP Parameter Tampering
    An attacker modifies the parameters of the SOAP message that is sent from the service consumer to the service provider to initiate a SQL injection attack. On the service provider side, the SOAP message is parsed and parameters are not properly validated before being used to access a database in a way that does not use parameter binding, thus enabling the attacker to control the structure of the executed SQL query. This pattern describes a SQL injection attack with the delivery mechanism being a SOAP message.
  • Expanding Control over the Operating System from the Database
    An attacker is able to leverage access gained to the database to read / write data to the file system, compromise the operating system, create a tunnel for accessing the host machine, and use this access to potentially attack other machines on the same network as the database machine. Traditionally SQL injections attacks are viewed as a way to gain unauthorized read access to the data stored in the database, modify the data in the database, delete the data, etc. However, almost every data base management system (DBMS) system includes facilities that if compromised allow an attacker complete access to the file system, operating system, and full access to the host running the database. The attacker can then use this privileged access to launch subsequent attacks. These facilities include dropping into a command shell, creating user defined functions that can call system level libraries present on the host machine, stored procedures, etc.
  • SQL Injection
    This attack exploits target software that constructs SQL statements based on user input. An attacker crafts input strings so that when the target software constructs SQL statements based on the input, the resulting SQL statement performs actions other than those the application intended. SQL Injection results from failure of the application to appropriately validate input. When specially crafted user-controlled input consisting of SQL syntax is used without proper validation as part of SQL queries, it is possible to glean information from the database in ways not envisaged during application design. Depending upon the database and the design of the application, it may also be possible to leverage injection to have the database execute system-related commands of the attackers' choice. SQL Injection enables an attacker to talk directly to the database, thus bypassing the application completely. Successful injection can cause information disclosure as well as ability to add or modify data in the database. In order to successfully inject SQL and retrieve information from a database, an attacker:

Exploit-Db

descriptionPassword Manager Pro / Pro MSP - Blind SQL Injection. CVE-2014-8498,CVE-2014-8499. Webapps exploits for multiple platform
fileexploits/multiple/webapps/35210.txt
idEDB-ID:35210
last seen2016-02-04
modified2014-11-10
platformmultiple
port
published2014-11-10
reporterPedro Ribeiro
sourcehttps://www.exploit-db.com/download/35210/
titlePassword Manager Pro / Pro MSP - Blind SQL Injection
typewebapps

Metasploit

descriptionManageEngine Password Manager Pro (PMP) has an authenticated blind SQL injection vulnerability in SQLAdvancedALSearchResult.cc that can be abused to escalate privileges and obtain Super Administrator access. A Super Administrator can then use his privileges to dump the whole password database in CSV format. PMP can use both MySQL and PostgreSQL databases but this module only exploits the latter as MySQL does not support stacked queries with Java. PostgreSQL is the default database in v6.8 and above, but older PMP versions can be upgraded and continue using MySQL, so a higher version does not guarantee exploitability. This module has been tested on v6.8 to v7.1 build 7104 on both Windows and Linux. The vulnerability is fixed in v7.1 build 7105 and above.
idMSF:AUXILIARY/ADMIN/HTTP/MANAGEENGINE_PMP_PRIVESC
last seen2020-06-10
modified2018-09-15
published2014-11-08
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/admin/http/manageengine_pmp_privesc.rb
titleManageEngine Password Manager SQLAdvancedALSearchResult.cc Pro SQL Injection

Nessus

NASL familyCGI abuses
NASL idMANAGEENGINE_PMP_7105.NASL
descriptionThe remote host is running a version of ManageEngine Password Manager Pro between 6.5 (inclusive) and 7.1 Build 7105. It is, therefore, affected by a blind SQL injection vulnerability due to a failure to validate the
last seen2020-06-01
modified2020-06-02
plugin id80960
published2015-01-23
reporterThis script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/80960
titleManageEngine Password Manager Pro 6.5 < 7.1 Build 7105 Blind SQL Injection
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(80960);
  script_version("1.8");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/12");

  script_cve_id("CVE-2014-8499");
  script_bugtraq_id(71018);

  script_name(english:"ManageEngine Password Manager Pro 6.5 < 7.1 Build 7105 Blind SQL Injection");
  script_summary(english:"Checks version of ManageEngine Password Manager Pro");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is running a web application affected by a SQL
injection vulnerability.");
  script_set_attribute(attribute:"description", value:
"The remote host is running a version of ManageEngine Password Manager
Pro between 6.5 (inclusive) and 7.1 Build 7105. It is, therefore,
affected by a blind SQL injection vulnerability due to a failure to
validate the 'SEARCH_ALL' parameter.");
  script_set_attribute(attribute:"see_also", value:"https://packetstormsecurity.com/files/129036");
  # http://www.manageengine.com/products/passwordmanagerpro/release-notes.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6b35a1c6");
  script_set_attribute(attribute:"solution", value:
"Upgrade to ManageEngine Password Manager Pro version 7.1 build 7105 or
later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2014/08/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/01/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2015/01/23");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:manageengine:password_manager_pro");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("manageengine_pmp_detect.nbin");
  script_require_keys("installed_sw/ManageEngine Password Manager Pro");
  script_require_ports("Services/www", 7272);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("install_func.inc");
include("http_func.inc");

appname = "ManageEngine Password Manager Pro";
# Stops get_http_port from branching
get_install_count(app_name:appname, exit_if_zero:TRUE);

port    = get_http_port(default:7272, embedded:TRUE);
install = get_single_install(app_name:appname,port:port,exit_if_unknown_ver:TRUE);
version = install['version'];
build   = install['build'  ];
url     = install['path'   ];
url     = build_url(port:port,qs:url);

if (
  (version =~ "^6\." && ver_compare(ver:version,fix:"6.5",strict:FALSE) >= 0)
  ||
  # Build for 7.1 Build 7105+ is reliable
  (version =~ "^7\." && int(build) < 7105)
)
{
  set_kb_item(name: 'www/'+port+'/SQLInjection', value: TRUE);
  if (report_verbosity > 0)
  {
    report = '\n  URL               : ' + url +
             '\n  Installed version : ' + version +
             '\n  Build (at least)  : ' + build +
             '\n  Fixed version     : 7.1 Build 7105\n';
    security_warning(port:port, extra:report);
  }
  else security_warning(port);
  exit(0);
}
else audit(AUDIT_WEB_APP_NOT_AFFECTED, appname, url,  version+" (at least build "+build+")");

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/129036/pmp-sql.txt
idPACKETSTORM:129036
last seen2016-12-05
published2014-11-09
reporterPedro Ribeiro
sourcehttps://packetstormsecurity.com/files/129036/Password-Manager-Pro-SQL-Injection.html
titlePassword Manager Pro SQL Injection

Seebug

bulletinFamilyexploit
descriptionNo description provided by source.
idSSV:87402
last seen2017-11-19
modified2014-11-13
published2014-11-13
reporterRoot
sourcehttps://www.seebug.org/vuldb/ssvid-87402
titlePassword Manager Pro / Pro MSP - Blind SQL Injection