Published: 01/05/2013 Updated: 16/11/2017

CVSS v2 Base Score: 7.9 | Impact Score: 10 | Exploitability Score: 5.5

VMScore: 795

Vector: AV:A/AC:M/Au:N/C:C/I:C/A:C

SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) prior to 4.5.7 and 4.6.x prior to 4.6.6 allows remote malicious users to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mcafee epolicy orchestrator 3.6.1
mcafee epolicy orchestrator 3.6.0
mcafee epolicy orchestrator 2.0
mcafee epolicy orchestrator 4.5.5
mcafee epolicy orchestrator 3.0
mcafee epolicy orchestrator 2.5
mcafee epolicy orchestrator 3.5.0
mcafee epolicy orchestrator 4.5.4
mcafee epolicy orchestrator 4.5.3
mcafee epolicy orchestrator
mcafee epolicy orchestrator 4.5.0
mcafee epolicy orchestrator 4.0
mcafee epolicy orchestrator 2.5.1
mcafee epolicy orchestrator 4.6.4
mcafee epolicy orchestrator 4.6.3
mcafee epolicy orchestrator 4.6.0
mcafee epolicy orchestrator 4.6.2
mcafee epolicy orchestrator 4.6.1
mcafee epolicy orchestrator 4.6.5

# Exploit Title: McAfee ePolicy Orchestrator 460-465 (ePowner) - Multiple vulnerabilities # Date: 20 November 2012 # Exploit Author: st3n@funoveripnet (aka jeromenokin@gmailcom) # Vendor Homepage: wwwmcafeecom/uk/products/epolicy-orchestratoraspx # Version: 460 -> 465 # Tested on: Windows 2003/2008 # CVE : CVE-2013-0140 , ...

McAfee ePolicy 0wner exploit code

INTRODUCTION This is "ePolicy 0wner", a sexy exploit aginst McAfee ePolicy Orchestrator versions 460 -> 465 Author: jeromenokin@gmailcom Blog: funoveripnet Discovered on: 20 November 2012 Fixed on: 25 April 2013 In short, this tool registers a rogue agent on the ePo server and then takes advantage of the following vulnerabilities to perfo

CWE-89 http://www.kb.cert.org/vuls/id/209131 https://kc.mcafee.com/corporate/index?page=content&id=SB10042 http://seclists.org/fulldisclosure/2014/Apr/289 http://www.securityfocus.com/bid/59500 http://www.us-cert.gov/ncas/alerts/TA13-193A https://nvd.nist.gov https://github.com/funoverip/epowner https://www.exploit-db.com/exploits/33071/https://www.kb.cert.org/vuls/id/209131

CVE-2013-0140

Vulnerability Summary

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect