CVE-2024-9459: 
Zoho ManageEngine Exchange Reporter Plus vulnerability analysis and mitigation

ManageEngine Exchange Reporter Plus versions 5718 and prior contain an authenticated SQL injection vulnerability in the reports module. The vulnerability was discovered and fixed in build 5719, released on November 1, 2024 (ManageEngine Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) by NIST with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. ManageEngine assigned a slightly lower score of 8.3 (HIGH) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. The vulnerability is classified as CWE-89 (SQL Injection) (NVD).

This vulnerability allows an authenticated adversary to execute custom queries and access entries in the database table using the vulnerable request (ManageEngine Advisory).

ManageEngine has released build 5719 to address this vulnerability. Customers are strongly advised to update their Exchange Reporter Plus installation to the latest build immediately. The update can be applied by downloading the latest service pack from the ManageEngine website and following the provided installation instructions (ManageEngine Advisory).