EUVD-2025-17450CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Lifecycle Timeline
3Description
Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the alerts module.
Analysis
Zohocorp ManageEngine ADAudit Plus versions 8510 and prior contain an authenticated SQL injection vulnerability in the alerts module (CWE-89) that allows authenticated users to execute arbitrary SQL commands. An attacker with valid credentials can exploit this network-accessible vulnerability to read sensitive data, modify database contents, or degrade system availability. The CVSS 8.3 score reflects high confidentiality and integrity impact, though authentication is required; real-world exploitation probability and active weaponization status cannot be confirmed without KEV/EPSS data access.
Technical Context
The vulnerability exists in the alerts module of ManageEngine ADAudit Plus, an Active Directory and user access auditing solution commonly deployed in enterprise Windows environments. The root cause is improper input validation/parameterization of SQL queries (CWE-89: SQL Injection) where user-supplied input from alert configuration or filtering parameters is concatenated directly into SQL statements without proper escaping or prepared statement usage. ADAudit Plus is typically deployed as a Java-based application server with backend database (MySQL, MSSQL, or Oracle depending on configuration). CPE would likely be: cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:* with version constraint <=8510. The vulnerability is specifically in the alerts module, suggesting the injection point exists in alert query/filtering/management functionality.
Affected Products
- vendor: Zohocorp; product: ManageEngine ADAudit Plus; affected_versions: 8510 and all prior versions; fixed_versions: Not specified in provided data—vendor advisory required; module: Alerts module; deployment_notes: Commonly deployed in enterprise Active Directory environments; typically runs on Windows Server with Java application server and relational database backend
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today