CVE-2015-7766: ManageEngine OpManager SQL query restriction bypass via comment injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw allows an authenticated administrator to bypass SQL restrictions with public exploit code available and a very high EPSS score, though it is not known to be exploited in the wild per KEV.

What it is

ZOHO ManageEngine OpManager 11.6, 11.5 and earlier fails to properly restrict SQL queries submitted through PGSQL:SubmitQuery.do at api/json/admin/SubmitQuery. An authenticated administrator can insert a comment such as "INSERT/**/INTO" to evade the query filter, and public exploit code exists for this issue.

Impact

An attacker with administrator access gains the ability to run SQL statements that the application intended to block, which can lead to full compromise of the confidentiality, integrity and availability of the affected system, as reflected in the CVSS 2.0 score of 9.0.

Attack surface

The flaw is reached remotely over HTTP through the api/json/admin/SubmitQuery endpoint. It requires an authenticated administrator account; no user interaction beyond submitting the crafted query is needed.

Exploitation

Public exploit code is referenced in Exploit-DB, Packet Storm and a Rapid7 Metasploit module, and EPSS is 0.80644 (99.6th percentile), indicating high likelihood of exploitation. The CVE is not listed in CISA KEV.

What to do

• Apply the vendor fix referenced in the ZOHO ManageEngine advisory for PGSQL:SubmitQuery.do.
• Upgrade OpManager to a version later than 11.6 if a fixed release is available.
• Restrict network access to api/json/admin/SubmitQuery to trusted management hosts only.
• Limit and audit administrator accounts, since exploitation requires admin privileges.
• Monitor and review SQL queries submitted through the PGSQL interface for comment-based evasion patterns.

Detection

• Inspect HTTP requests to api/json/admin/SubmitQuery for SQL comment sequences such as /**/ or --.
• Alert on SQL statements containing INSERT, UPDATE or DELETE keywords in the SubmitQuery parameter.
• Review OpManager logs for unexpected administrative query activity from unusual source IPs.
• Correlate administrator logins with subsequent database or system changes on the OpManager host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.