|
Description
|
|
Pedro Ribeiro has reported two vulnerabilities in ManageEngine Password Manager Pro, which can be exploited by malicious people to conduct SQL injection attacks.
1) Input passed via the "sv" GET parameter to the LinkViewFetchServlet servlet is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
2) Input passed via the "sv" GET parameter to the MetadataServlet servlet is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
The vulnerabilities are reported in versions 7.0 build 7002 and prior.
|
