CVE-2014-7868

Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the (1) OPM_BVNAME parameter in a Delete operation to the APMBVHandler servlet or (2) query parameter in a compare operation to the DataComparisonServlet servlet.

• CWE-89

• http://packetstormsecurity.com/files/129037/ManageEngine-OpManager-Social-IT-Plus-IT360-File-Upload-SQL-Injection.htmlExploit
• http://seclists.org/fulldisclosure/2014/Nov/21Exploit
• http://www.securityfocus.com/archive/1/533946/100/0/threaded
• http://www.securityfocus.com/bid/71002Exploit
• https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txtExploit
• https://support.zoho.com/portal/manageengine/helpcenter/articles/sql-injection-vulnerability-fixExploit, Patch
• http://packetstormsecurity.com/files/129037/ManageEngine-OpManager-Social-IT-Plus-IT360-File-Upload-SQL-Injection.htmlExploit
• http://seclists.org/fulldisclosure/2014/Nov/21Exploit
• http://www.securityfocus.com/archive/1/533946/100/0/threaded
• http://www.securityfocus.com/bid/71002Exploit
• https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txtExploit
• https://support.zoho.com/portal/manageengine/helpcenter/articles/sql-injection-vulnerability-fixExploit, Patch

Published

Dec 4, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-7862The DCPluginServelet servlet in ManageEngine Desktop Central…
• CVE-2014-7863The FailOverHelperServlet (aka FailServlet) servlet in ZOHO …7.5
• CVE-2014-7864Multiple SQL injection vulnerabilities in the FailOverHelper…
• CVE-2014-7865Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-7866Multiple directory traversal vulnerabilities in ZOHO ManageE…
• CVE-2014-7867SQL injection vulnerability in the com.manageengine.opmanage…
• CVE-2014-7869Cross-site scripting (XSS) vulnerability in the configuratio…
• CVE-2014-7870Cross-site scripting (XSS) vulnerability in the Custom Searc…
• CVE-2014-7871SQL injection vulnerability in Open-Xchange (OX) AppSuite be…
• CVE-2014-7872Comodo GeekBuddy before 4.18.121 does not restrict access to…
• CVE-2014-7874Cross-site request forgery (CSRF) vulnerability in HP System…
• CVE-2014-7875Unspecified vulnerability on the HP LaserJet CM3530 Multifun…