CVE-2015-7387

High

Published: 28/09/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

ZOHO ManageEngine EventLog Analyzer version 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do.

Risk Assessment

Attackers can exploit this vulnerability to gain unauthorized access to the database, potentially leading to data loss or modification.

Recommendation

It is recommended to upgrade to version 11200 or later to mitigate this vulnerability.

Other vulnerabilities in ZOHO ManageEngine EventLog Analyzer

CVE-2014-6037High
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a ZIP file which contains an executable file with .. (dot dot) sequences in its name.

Original NVD description (English source)

ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO." Fixed in Build 11200.