CVE-2024-36035: 
Zoho ManageEngine ADAudit Plus vulnerability analysis and mitigation

Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in user session recording. The vulnerability was discovered and disclosed on August 12, 2024, and affects all ADAudit Plus builds below version 8003. The issue was fixed in build 8003, released on April 29, 2024 (ManageEngine Advisory).

The vulnerability is classified as SQL Injection (CWE-89) with a CVSS v3.1 base score of 8.8 (High). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N). The scope is unchanged (S:U) with high impact on confidentiality, integrity, and availability (C:H/I:H/A:H) (NVD).

This vulnerability can allow an authenticated adversary to execute custom queries and access the database table entries using the vulnerable request in the User Session Recording functionality (ManageEngine Advisory).

The vulnerability requires authentication to exploit and affects the User Session Recording feature. The attack can be executed remotely over the network with low complexity, making it relatively straightforward to exploit for authenticated users (NVD).

Organizations are advised to update their ADAudit Plus instance to build 8003 using the service pack. This version contains the fix for the SQL injection vulnerability (ManageEngine Advisory).

The vulnerability was reported by Minh Vo Van (aka minhgalaxy) at bl4ckh0l3 from GalaxyOne (ManageEngine Advisory).