ManageEngine Analytics Plus Unauthenticated SQL Injection Vulnerability

A critical unauthenticated SQL injection vulnerability has been identified in ManageEngine Analytics Plus on-premise versions through 6170. This vulnerability arises from improper input validation, allowing attackers to execute arbitrary SQL queries. Exploitation of this issue could lead to unauthorized access to user information and potential account takeovers.

Impact

Exploitation of this vulnerability could result in unauthorized access to user data, with the possibility of account takeovers.

Remediation

Users can upgrade to the latest version by downloading the upgrade pack from the ManageEngine Analytics Plus service pack page and following the provided upgrade instructions.