Manageengine Adaudit Plus EUVD-2025-17451

This vulnerability presents HIGH real-world risk across multiple dimensions: (1) CVSS 8.3 with network-accessible attack vector (AV:N), low complexity (AC:L), and low privilege requirements (PR:L) indicates broad exploitability; (2) Authentication requirement (PR:L) slightly reduces risk in externally-facing scenarios but represents minimal friction in enterprise environments where legitimate users exist; (3) High confidentiality (C:H) and integrity impact (I:H) combined with partial availability impact (A:L) align with SQL injection's typical capability to read/modify data; (4) Although no explicit KEV status or POC availability is documented in provided data, SQL injection vulnerabilities in database-backed administrative tools are historically high-priority targets for post-compromise lateral movement and credential harvesting; (5) The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U) suggests exploitation is straightforward once a valid account is obtained, making this a critical concern for insider threats and account compromise scenarios. Organizations with compromised user accounts or inadequate access controls face immediate exploitation risk.

An authenticated user with standard auditor or viewer permissions to ADAudit Plus gains access to the Service Account Auditing reports interface. The attacker identifies a report filter parameter (e.g., service account name, date range, or audit action) that is passed directly to the backend SQL query without sanitization. By injecting SQL metacharacters (single quotes, UNION operators, etc.) into a filter field, the attacker crafts a malicious query such as: 'serviceAccountName' UNION SELECT username, password_hash, domain FROM users_table -- which extracts sensitive stored credentials or access logs. Alternatively, the attacker uses stacked queries (;DROP TABLE audit_logs;--) to delete audit evidence. Because this is an authenticated vulnerability, exploitation requires a valid ADAudit Plus user account—realistic scenarios include: (1) a disgruntled IT staff member performing credential theft, (2) a compromised standard domain user account leveraged post-breach for lateral movement, or (3) a guest/contractor account with inadvertent access. No public POC is required; SQL injection in web applications is well-documented, and the specific parameters vulnerable to injection can be identified through web request interception (Burp Suite) or by analyzing error messages in ADAudit Plus logs.