Test ID:	1.3.6.1.4.1.25623.1.0.805103
Category:	Web application abuses
Title:	ManageEngine OpManager Multiple Vulnerabilities (Nov 2014) - Active Check
Summary:	ManageEngine OpManager is prone to multiple vulnerabilities.
Description:	Summary: ManageEngine OpManager is prone to multiple vulnerabilities. Vulnerability Insight: Multiple flaws are due to: - /servlet/MigrateLEEData script not properly sanitizing user input, specifically path traversal style attacks (e.g. '../') supplied via the 'fileName' parameter. - /servlet/MigrateCentralData script not properly sanitizing user input, specifically path traversal style attacks (e.g. '../') supplied via the 'zipFileName' parameter. - /servlet/APMBVHandler script not properly sanitizing user-supplied input to the 'OPM_BVNAME' POST parameter. - /servlet/DataComparisonServlet script not properly sanitizing user-supplied input to the 'query' POST parameter. Vulnerability Impact: Successful exploitation will allow attackers to upload arbitrary files and execute the script within the file with the privileges of the web server, manipulate SQL queries in the backend database, and disclose certain sensitive information. Affected Software/OS: ManageEngine OpManager version 11.3/11.4. Solution: Apply the patches from the referenced links. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-7866 Bugtraq: 20141109 [The ManageOwnage series, part VIII]: Remote code execution and blind SQLi in OpManager, Social IT and IT360 (Google Search) http://www.securityfocus.com/archive/1/533946/100/0/threaded http://seclists.org/fulldisclosure/2014/Nov/21 http://packetstormsecurity.com/files/129037/ManageEngine-OpManager-Social-IT-Plus-IT360-File-Upload-SQL-Injection.html https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt Common Vulnerability Exposure (CVE) ID: CVE-2014-7868 BugTraq ID: 71002 http://www.securityfocus.com/bid/71002 Common Vulnerability Exposure (CVE) ID: CVE-2014-6035 http://seclists.org/fulldisclosure/2014/Sep/110
Copyright	Copyright (C) 2014 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.