Overview
The IT world has been alerted to yet another security vulnerability, this time within Zohocorp ManageEngine ADAudit Plus software. As CVE-2025-36528, this vulnerability constitutes a significant threat to the safety and privacy of data stored within organizations utilizing versions 8510 and prior of the ADAudit Plus product. In essence, this vulnerability opens the door to authenticated SQL injection attacks, leading to potential system compromise and data leakage. The severity of this issue has been emphasized by its CVSS Severity Score of 8.3, indicating a high impact threat.
Vulnerability Summary
CVE ID: CVE-2025-36528
Severity: High (8.3/10)
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Zohocorp ManageEngine ADAudit Plus | Versions 8510 and prior
How the Exploit Works
The exploit takes advantage of a lack of proper sanitization for user-supplied input in Service Account Auditing reports within the affected software. An attacker with authenticated access can inject malicious SQL commands, which then execute in the context of the application’s database. This allows the attacker to view, modify, or delete data, potentially leading to a full system compromise.
Conceptual Example Code
Given the nature of this vulnerability, an attacker could potentially exploit it using a specially crafted HTTP request. The following pseudocode provides a conceptual example of how this might occur:
POST /ADAuditPlus/ServiceAccountAuditReport HTTP/1.1
Host: target.example.com
Content-Type: application/json
Authorization: Bearer <Authenticated User Token>
{
"report_parameters": "'; DROP TABLE users; --"
}In this example, the attacker submits a maliciously crafted ‘report_parameters’ value that contains SQL commands. These commands could lead to harmful actions such as deletion of crucial data tables.
Mitigation and Prevention
The vendor, Zohocorp, has released a patch that addresses this vulnerability. As such, users of the affected software versions are urged to apply the patch as soon as possible. For temporary mitigation, users can employ Web Application Firewalls (WAFs) or Intrusion Detection Systems (IDS) to detect and block SQL injection attempts. However, these measures are not long-term solutions and should be followed by patch application.