CVE-2024-36034: 
Zoho ManageEngine ADAudit Plus vulnerability analysis and mitigation

CVE-2024-36034 is a high-severity vulnerability affecting Zohocorp ManageEngine ADAudit Plus versions below build 8003. The vulnerability was discovered and disclosed in April 2024, specifically impacting the aggregate reports' search option functionality in the software. This authenticated SQL injection vulnerability affects all ADAudit Plus builds prior to version 8003 (Vendor Advisory).

The vulnerability is classified as an SQL Injection (CWE-89) with a CVSS v3.1 base score of 8.8 (High), characterized by the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability requires authentication to exploit and specifically exists in the search functionality of the aggregate reports feature (NVD).

When exploited, this vulnerability allows an authenticated adversary to execute custom queries and gain unauthorized access to database table entries through the vulnerable request. The high CVSS score indicates potential severe impacts on the confidentiality, integrity, and availability of the affected system (Vendor Advisory).

The vulnerability requires authentication for exploitation, indicating a slightly reduced attack surface. However, once authenticated, the attack complexity is considered low, requiring no user interaction for successful exploitation (NVD).

The vulnerability has been patched in ADAudit Plus build 8003, released on April 29, 2024. Organizations using affected versions are strongly advised to update their ADAudit Plus instance to build 8003 using the service pack (Vendor Advisory).

The vulnerability was responsibly disclosed by security researcher Minh Vo Van (aka minhgalaxy) from bl4ckh0l3 at GalaxyOne (Vendor Advisory).