CVE-2024-48878: 
Zoho ManageEngine ADManager Plus vulnerability analysis and mitigation

CVE-2024-48878 affects Zohocorp ManageEngine ADManager Plus versions 7241 and prior, where a SQL Injection vulnerability exists in the Archived Audit Report feature. The vulnerability was discovered and disclosed in November 2024, with a CVSS v3.1 base score of 8.8 (HIGH) (NVD).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The vulnerability has received a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and requires low privileges with no user interaction (NVD).

The vulnerability could allow an authenticated adversary to execute custom queries and gain unauthorized access to database table entries through the vulnerable request (ManageEngine Advisory).

The vulnerability requires authentication for exploitation, indicating that an attacker would need valid credentials to exploit the SQL injection vulnerability (ManageEngine Advisory).

The vulnerability has been fixed in ADManager Plus version 7250, released on October 4, 2024. Users are advised to update their ADManager Plus instance to the latest build by installing the service pack (ManageEngine Advisory).