CVE-2023-49332: 
Zoho ManageEngine ADAudit Plus vulnerability analysis and mitigation

Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares. The vulnerability was discovered and disclosed in November 2023, affecting the file share configuration functionality of the application (ManageEngine Advisory).

The vulnerability is classified as an SQL injection vulnerability that specifically affects the file share addition functionality in ADAudit Plus. The CVSS v3.1 base score for this vulnerability is 8.3 HIGH, with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. This indicates that the vulnerability requires low attack complexity and can be exploited remotely with low privileges and no user interaction (NVD).

If successfully exploited, this vulnerability allows an authenticated adversary to execute custom queries and access the database table entries using the vulnerable request. The high CVSS score indicates significant potential impact on confidentiality and integrity of the system, with some impact on availability (ManageEngine Advisory).

The vulnerability requires authentication to exploit, indicating that an attacker would need valid credentials to the ADAudit Plus system. The low attack complexity suggests that once authenticated, the vulnerability is relatively straightforward to exploit (NVD).

The vulnerability has been fixed in ADAudit Plus build 7271, released on January 12, 2024. Organizations using affected versions should immediately upgrade to build 7271 using the service pack to remediate this vulnerability (ManageEngine Advisory).