CVE-2015-7766
HighSummary
In ZOHO ManageEngine OpManager versions 11.6, 11.5, and earlier, remote administrators can bypass SQL query restrictions by adding a comment in the query to api/json/admin/SubmitQuery, as demonstrated by 'INSERT/**/INTO'.
Risk Assessment
Bypassing SQL query restrictions may lead to unauthorized access to data or execution of harmful operations in the database, posing a serious security threat to the organization.
Recommendation
It is recommended to update ZOHO ManageEngine OpManager to the latest version to mitigate this vulnerability and implement additional security measures to monitor and restrict access to critical API endpoints.
Other vulnerabilities in ZOHO ManageEngine OpManager
See all- CVE-2015-7765High
ZOHO ManageEngine OpManager version 11.5 build 11600 and earlier uses a hardcoded password 'plugin' for the IntegrationUser account, allowing remote authenticated users to gain administrator access by leveraging knowledge of this password.
- CVE-2015-9107Critical
Zoho ManageEngine OpManager versions 11 through 12.2 uses a custom encryption algorithm to protect the credentials used to access monitored devices. The implemented algorithm does not use a per-system key or even a salt, making it possible to create a universal decryptor.
Original NVD description (English source)
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT/**/INTO."