Manageengine Adaudit Plus EUVD-2025-17450

CVSS 8.3 (High) with AV:N/AC:L/PR:L indicates significant but bounded risk: the vulnerability is network-accessible with low attack complexity, but requires valid authentication credentials (PR:L), which is a meaningful barrier in practice. High impact on confidentiality (C:H) and integrity (I:H) with lower availability impact (A:L) suggests data exfiltration and modification are primary concerns over system outage. Real-world priority depends critically on: (1) EPSS exploitation probability (unknown here—would indicate if this is actively exploited in the wild), (2) KEV/CISA status (unknown—would indicate government awareness/active exploitation), (3) POC availability (unknown—critical factor for ease of weaponization). The authentication requirement significantly reduces exposure compared to unauthenticated SQL injection, limiting attackers to compromised accounts or insider threats. Organizations with strong credential management and network segmentation face lower practical risk than those with weak access controls. Without EPSS/KEV data, recommend treating as HIGH priority for organizations running vulnerable versions, particularly if exposed to untrusted internal users.

A threat actor obtains valid credentials for ManageEngine ADAudit Plus (via phishing, credential compromise, or insider threat). The attacker navigates to the alerts configuration or alert query interface and injects SQL code into an alert filter/search parameter (e.g., a date range field, alert name filter, or severity selector). Due to lack of input parameterization, the malicious SQL is concatenated into the backend query and executed with database privileges of the application. The attacker exfiltrates sensitive data from the ADAudit database (user account hashes, audit logs, administrative activities) or modifies audit records to cover tracks of malicious activity. If the database user has elevated privileges, the attacker may pivot to underlying database server or other systems. Attack complexity is low (AC:L) once credentials are obtained, making this exploitable by moderately skilled attackers. POC availability would significantly lower barriers to exploitation—if public POC exists, this becomes a critical priority for all organizations running vulnerable versions.