CVE-2024-36485: 
Zoho ManageEngine ADAudit Plus vulnerability analysis and mitigation

ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in the Technician reports option. This vulnerability was discovered internally and fixed in build 8121, released on August 19, 2024. The vulnerability affects all ADAudit Plus builds prior to version 8121 (ManageEngine Advisory).

The vulnerability is classified as a SQL Injection vulnerability with a CVSS v3 Base Score of 8.8 (High). The attack vector is Network-based, with low attack complexity and requiring low privileges. No user interaction is needed for exploitation. The vulnerability impacts confidentiality, integrity, and availability, all rated as High (AttackerKB).

When exploited, this vulnerability could allow an authenticated adversary to execute custom queries and access the database table entries using the vulnerable request in the Technician reports option (ManageEngine Advisory).

Organizations are advised to update their ADAudit Plus instance to build 8121 using the service pack. This is the only confirmed mitigation for this vulnerability (ManageEngine Advisory).