ManageEngine PAM360 and Password Manager Pro Authenticated SQL Injection Vulnerability

A high-severity authenticated SQL injection vulnerability has been identified in ManageEngine PAM360 versions prior to 8531 and in ManageEngine Password Manager Pro versions from 8600 to 13230. The vulnerability exists in the query report module, allowing an adversary with a Password Auditor role to execute custom SQL queries. This could lead to escalation of privileges to a Privileged Administrator, enabling the execution of sensitive actions.

Impact

Exploitation of this vulnerability allows for authenticated SQL injection, with potential escalation of privileges to a Privileged Administrator role, where sensitive actions can be performed.

Remediation

Users can upgrade to ManageEngine Password Manager Pro version 13231 or ManageEngine PAM360 version 8531. Instructions for downloading the latest upgrade packs are available on the ManageEngine website.