Volerion logoVolerion
Volerion logoVolerion

ManageEngine ADAudit Plus Authenticated SQL Injection Vulnerability in Service Account Auditing Reports

Vulnerability

A SQL injection vulnerability has been identified in ManageEngine ADAudit Plus, affecting all versions prior to 8511. This vulnerability allows authenticated users to inject malicious SQL queries into the Service Account Auditing reports export API, potentially leading to unauthorized database access.

Impact

Exploitation of this vulnerability could enable authenticated users to execute arbitrary SQL queries, allowing them to access and manipulate database information.

Remediation

Users are advised to update their ADAudit Plus instance to the latest build, 8511, using the available service pack.

Added: Jun 9, 2025, 11:21 AM
Updated: Jun 9, 2025, 12:23 PM

Vulnerability Rating

Custom Algorithm
spread
5.0
impact
2.5
exploitability
5.2
remediation
7.7
relevance
0.2
threat
0.1
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.