CVE-2023-49333: 
Zoho ManageEngine ADAudit Plus vulnerability analysis and mitigation

Zoho ManageEngine ADAudit Plus versions below 7271 contain a SQL injection vulnerability in the dashboard graph feature. The vulnerability was discovered and disclosed in May 2024, and was assigned CVE-2023-49333. The affected software is ManageEngine ADAudit Plus, a tool used for Active Directory auditing and security (ManageEngine Advisory).

The vulnerability is classified as SQL injection (CWE-89) that exists in the dashboard graph feature of the application. According to the CVSS 3.1 scoring, it has received a base score of 8.3 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L (NVD).

If exploited, this vulnerability allows an authenticated adversary to execute custom queries and access the database table entries using the vulnerable request. The high CVSS score indicates significant potential impact on confidentiality and integrity of the system (ManageEngine Advisory).

The vulnerability requires authentication to exploit, making it an authenticated SQL injection vulnerability. The attack complexity is rated as low, requiring only limited privileges and no user interaction for successful exploitation (NVD).

The vulnerability has been fixed in ADAudit Plus build 7271. Organizations using affected versions should update their ADAudit Plus instance to build 7271 using the service pack to remediate this vulnerability (ManageEngine Advisory).

The vulnerability was reported by security researcher minhgalaxy, demonstrating the active involvement of the security research community in identifying and responsibly disclosing vulnerabilities in enterprise software (ManageEngine Advisory).