CVE-2023-49330: 
Zoho ManageEngine ADAudit Plus vulnerability analysis and mitigation

Zoho ManageEngine ADAudit Plus versions below 7271 contains an SQL Injection vulnerability (CVE-2023-49330) that affects the aggregate report data functionality. The vulnerability was discovered and reported by minhgalaxy, and was fixed in build 7271 released on January 12, 2024 (ManageEngine Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 8.3 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. The vulnerability is classified as CWE-89 (SQL Injection) and affects the Dashboard's Graphical and Summary views, specifically while getting aggregate report data (NVD, ManageEngine Advisory).

An authenticated adversary can exploit this vulnerability to execute custom queries and access the database table entries using the vulnerable request (ManageEngine Advisory).

The vulnerability requires authentication to exploit, as indicated by the CVSS metrics showing Privileged Required (PR:L). The attack complexity is considered low (AC:L), and no user interaction (UI:N) is needed to exploit the vulnerability (ManageEngine Advisory).

Users are advised to update their ADAudit Plus instance to build 7271 or later using the service pack to remediate this vulnerability (ManageEngine Advisory).