CVE-2023-49334: 
Zoho ManageEngine ADAudit Plus vulnerability analysis and mitigation

Zoho ManageEngine ADAudit Plus versions below 7271 contains a SQL Injection vulnerability while exporting a full summary report. The vulnerability was discovered and disclosed in late 2023, with a fix released on January 12, 2024. This security issue affects all ADAudit Plus installations running versions prior to build 7271 (ManageEngine Advisory).

The vulnerability is classified as a SQL Injection type (CWE-89), allowing authenticated users to execute custom queries and access database table entries through the vulnerable request in the full summary report export functionality. The severity of this vulnerability has been rated as HIGH with a CVSS v3.1 base score of 8.3 (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) (NVD).

If exploited, this vulnerability could allow an authenticated adversary to execute arbitrary SQL queries, potentially accessing sensitive information stored in the database tables. The high CVSS score indicates significant potential impact on the confidentiality and integrity of the system, with some effect on availability (ManageEngine Advisory).

The vulnerability requires authentication to exploit, indicating that an attacker would need valid credentials to the ADAudit Plus system. The attack complexity is rated as low, suggesting that once authenticated, the exploitation process is straightforward (NVD).

The vulnerability has been fixed in ADAudit Plus build 7271. Organizations are strongly advised to update their ADAudit Plus installations to this version using the service pack. The fix was released on January 12, 2024 (ManageEngine Advisory).