{"uuid": "ed582389-40a6-4cf5-9d2e-e88993c9da1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-8499", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/manageengine_pmp_privesc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Pedro Ribeiro \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"ManageEngine Password Manager Pro (PMP) has an authenticated blind SQL injection\\n          vulnerability in SQLAdvancedALSearchResult.cc that can be abused to escalate\\n          privileges and obtain Super Administrator access. A Super Administrator can then\\n          use his privileges to dump the whole password database in CSV format. PMP can use\\n          both MySQL and PostgreSQL databases but this module only exploits the latter as\\n          MySQL does not support stacked queries with Java. PostgreSQL is the default database\\n          in v6.8 and above, but older PMP versions can be upgraded and continue using MySQL,\\n          so a higher version does not guarantee exploitability. This module has been tested\\n          on v6.8 to v7.1 build 7104 on both Windows and Linux. The vulnerability is fixed in\\n          v7.1 build 7105 and above.\", \"disclosure_date\": \"2014-11-08\", \"fullname\": \"auxiliary/admin/http/manageengine_pmp_privesc\", \"is_install_path\": true, \"mod_time\": \"2026-04-15 11:57:01 +0000\", \"name\": \"ManageEngine Password Manager SQLAdvancedALSearchResult.cc Pro SQL Injection\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/admin/http/manageengine_pmp_privesc.rb\", \"platform\": \"\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"admin/http/manageengine_pmp_privesc\", \"references\": [\"CVE-2014-8499\", \"OSVDB-114485\", \"URL-https://seclists.org/fulldisclosure/2014/Nov/18\", \"URL-https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_pmp_privesc.txt\"], \"rport\": 7272, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:47.776188Z"}