cve/2015/CVE-2015-7766.md

CVE-2015-7766

Description

PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT/**/INTO."

POC

Reference

• http://packetstormsecurity.com/files/133596/ManageEngine-OpManager-Remote-Code-Execution.html
• http://seclists.org/fulldisclosure/2015/Sep/66
• https://www.exploit-db.com/exploits/38221/

Github

No PoCs found on GitHub currently.