Vulnerability record · CVE-2014-7868 · published 4 December 2014
CVE-2014-7868: ManageEngine OpManager, IT360 and Social IT Plus SQL injection
Zohocorp · Manageengine Social It Plus
Multiple SQL injection flaws exist in ZOHO ManageEngine OpManager 11.3/11.4, IT360 10.3/10.4 and Social IT Plus 11.0. The OPM_BVNAME parameter in a Delete operation to the APMBVHandler servlet and the query parameter in a compare operation to the DataComparisonServlet are both injectable, letting attackers run arbitrary SQL against the backend database.
Description
Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the (1) OPM_BVNAME parameter in a Delete operation to the APMBVHandler servlet or (2) query parameter in a compare operation to the DataComparisonServlet servlet.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityPublic exploit code exists and EPSS is very high, but the flaw is old and requires the affected legacy product versions to be exposed.
What it is
Multiple SQL injection flaws exist in ZOHO ManageEngine OpManager 11.3/11.4, IT360 10.3/10.4 and Social IT Plus 11.0. The OPM_BVNAME parameter in a Delete operation to the APMBVHandler servlet and the query parameter in a compare operation to the DataComparisonServlet are both injectable, letting attackers run arbitrary SQL against the backend database.
Impact
An attacker can read, modify or delete data in the application database and, depending on database privileges, potentially execute commands or pivot further into the environment.
Attack surface
Reachable over the network through the APMBVHandler and DataComparisonServlet endpoints; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication is required for at least one path, though the description also notes remote authenticated users can trigger it. No user interaction is needed.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.733 probability, 99.4th percentile) and multiple references are tagged Exploit, including public PoC and Full Disclosure posts, so working exploit code is publicly available.
What to do
- Apply the vendor fix referenced in the ZOHO ManageEngine support article for the SQL injection vulnerability.
- Upgrade OpManager, IT360 and Social IT Plus to versions later than 11.4, 10.4 and 11.0 respectively, or to the vendor's current supported release.
- Restrict network access to the APMBVHandler and DataComparisonServlet endpoints to trusted management networks only.
- Enforce least privilege on the database account used by these applications to limit the impact of successful injection.
- Deploy a WAF rule set covering SQL injection patterns on the affected servlets as a compensating control until patching is complete.
Detection
- Monitor web and application logs for requests to APMBVHandler with unusual OPM_BVNAME values or to DataComparisonServlet with suspicious query parameters.
- Alert on SQL error strings or database error responses returned by these servlets.
- Baseline normal parameter lengths and characters for these endpoints and alert on deviations.
- Review database audit logs for unexpected SELECT, UNION, or stacked queries originating from the application server.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-7868 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-7868), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
