CVE-2024-5556: 
Zoho ManageEngine ADAudit Plus vulnerability analysis and mitigation

Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to an authenticated SQL injection vulnerability in the reports module. The vulnerability was discovered and disclosed on August 23, 2024, and was assigned CVE-2024-5556. The affected software is ManageEngine ADAudit Plus, a tool used for Active Directory auditing and reporting (NVD, ManageEngine Advisory).

The vulnerability is classified as an authenticated SQL injection with a CVSS v3.1 base score of 8.8 (High). The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, low privileges required, no user interaction needed, and high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-89: Improper Neutralization of Special Elements used in an SQL Command (NVD).

If exploited, this vulnerability could allow an authenticated adversary to execute custom queries and access the database table entries using the vulnerable request in the reports module. The high CVSS score indicates significant potential impact on system confidentiality, integrity, and availability (ManageEngine Advisory).

The vulnerability has been fixed in ManageEngine ADAudit Plus build 8000, released on March 01, 2024. Organizations are advised to update their ADAudit Plus instances to build 8000 using the service pack to remediate this vulnerability (ManageEngine Advisory).

The vulnerability was reported by security researcher minhgalaxy. ManageEngine has acknowledged the vulnerability and provided a fix in their latest build (ManageEngine Advisory).