rapid7/metasploit-framework — pull request #3685 by pedrib (2014-08-21 14:34:38+00:00)
Title: Add exploit for CVE-2014-3996

This is an exploit for a blind SQL injection in ManageEngine Password Manager Pro and Desktop Central.
This module exploits the SQL injection via a GET request, which means it can only inject up to 8000 characters at a time. The workaround is to create several 8K fragments on the disk, and they use the JSP payload to assemble them as a proper exploit. This module has been thoroughly tested in several versions in Windows and Linux.