CVE-2015-7387: ManageEngine EventLog Analyzer SQL injection via runQuery.do query parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote SQL injection with public exploit code and very high EPSS probability, though not listed in CISA KEV.

What it is

ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier fails to properly restrict the query parameter to event/runQuery.do, allowing an allowed query to be followed by a disallowed one (for example "SELECT 1;INSERT INTO"). This lets a remote attacker execute arbitrary SQL commands against the application's backend database. The flaw is fixed in Build 11200.

Impact

An unauthenticated remote attacker can execute arbitrary SQL statements, enabling data theft, modification or deletion of database contents, and potentially further compromise of the host depending on database privileges.

Attack surface

Reached over the network via HTTP requests to event/runQuery.do with a crafted query parameter. The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Public exploit code is referenced in multiple Exploit-DB, Packet Storm, Full Disclosure and Rapid7 entries, and EPSS is 0.80192 (99.6th percentile), indicating high likelihood of exploitation. The CVE is not listed in CISA KEV.

What to do

• Upgrade ManageEngine EventLog Analyzer to Build 11200 or later, which contains the fix.
• If immediate upgrade is not possible, restrict network access to the EventLog Analyzer web interface to trusted management networks only.
• Apply input validation and parameterized queries to the runQuery.do endpoint if any custom code or workaround is deployed.
• Monitor and review database account privileges used by the application to limit the impact of successful SQL injection.
• Audit logs for unexpected SQL statements or anomalous requests to event/runQuery.do.

Detection

• Inspect web server and application logs for requests to event/runQuery.do containing semicolons or stacked SQL statements in the query parameter.
• Alert on SQL error messages or unusual database queries originating from the EventLog Analyzer application.
• Monitor for outbound or lateral connections from the EventLog Analyzer host that could indicate post-exploitation activity.
• Use the available public exploit signatures (Exploit-DB 38173, 38352; Rapid7 module) to build IDS/IPS rules for known payload patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.