CVE-2022-40300 SQL injection in n/a
Attackers can exploit SQL injection flaws in ManageEngine products to read or modify sensitive database information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-40300?
CVE-2022-40300 is a critical SQL injection vulnerability in n/a, published on 16 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vulnerabilities.
Weakness: CWE-89
Which versions are affected by CVE-2022-40300?
It affects 3 products.
Products include Zohocorp Manageengine Access Manager Plus, Zohocorp Manageengine Pam360, Zohocorp Manageengine Password Manager Pro.
How do I fix CVE-2022-40300?
No fix has been published for CVE-2022-40300 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2022-40300 being exploited?
There is no known exploitation of CVE-2022-40300 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-mvcp-j3fp-64mm.