CVE-2024-5527: 
Zoho ManageEngine ADAudit Plus vulnerability analysis and mitigation

Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to an authenticated SQL Injection vulnerability in the file auditing configuration. The vulnerability was discovered by Nhien Pham (@nhienit) at Galaxy One and was fixed in build 8110 released on June 14, 2024 (Vendor Advisory).

The vulnerability is classified as SQL Injection (CWE-89) with a CVSS v3.1 base score of 8.8 (HIGH) according to NIST's assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). ManageEngine's own assessment rates it slightly lower at 8.3 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L (NVD).

This vulnerability could allow an authenticated adversary to execute custom queries and access the database table entries using the vulnerable request (Vendor Advisory).

The vulnerability requires authentication to exploit, as indicated by the CVSS metrics showing PR:L (Privileged Required: Low). The attack complexity is rated as low (AC:L), and no user interaction (UI:N) is required (NVD).

Users are advised to update their ADAudit Plus instance to build 8110 using the service pack to remediate this vulnerability (Vendor Advisory).