{"id":52102,"date":"2025-06-15T05:02:00","date_gmt":"2025-06-15T05:02:00","guid":{"rendered":""},"modified":"2025-07-08T23:21:30","modified_gmt":"2025-07-09T05:21:30","slug":"cve-2025-36528-authenticated-sql-injection-in-zohocorp-manageengine-adaudit-plus","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-36528-authenticated-sql-injection-in-zohocorp-manageengine-adaudit-plus\/","title":{"rendered":"CVE-2025-36528: Authenticated SQL Injection in Zohocorp ManageEngine ADAudit Plus<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The IT world has been alerted to yet another security vulnerability, this time within Zohocorp ManageEngine ADAudit Plus software. As CVE-2025-36528, this vulnerability constitutes a significant threat to the safety and privacy of data stored within organizations utilizing versions 8510 and prior of the ADAudit Plus product. In essence, this vulnerability opens the door to authenticated SQL injection attacks, leading to potential system compromise and data leakage<\/a>. The severity of this issue<\/a> has been emphasized by its CVSS Severity Score of 8.3, indicating a high impact threat.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-36528
\nSeverity: High (8.3\/10)
\nAttack Vector: Network
\nPrivileges Required: Low
\nUser Interaction: Required
\nImpact: Potential system compromise<\/a> or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Zohocorp ManageEngine ADAudit Plus | Versions 8510 and prior<\/a><\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit takes advantage of a lack of proper sanitization for user-supplied input in Service Account Auditing reports within the affected software<\/a>. An attacker with authenticated access can inject malicious SQL<\/a> commands, which then execute in the context of the application’s database. This allows the attacker to view, modify, or delete data, potentially leading to a full system<\/a> compromise.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Given the nature of this vulnerability, an attacker could potentially exploit it using a specially crafted HTTP request<\/a>. The following pseudocode provides a conceptual example of how this might occur:<\/p>\n

POST \/ADAuditPlus\/ServiceAccountAuditReport HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/json\nAuthorization: Bearer \n{\n\"report_parameters\": \"'; DROP TABLE users; --\"\n}<\/code><\/pre>\n
In this example, the attacker submits a maliciously crafted ‘report_parameters’ value that contains SQL<\/a> commands. These commands could lead<\/a> to harmful actions such as deletion of crucial data tables.<\/p>\n
Mitigation and Prevention<\/strong><\/p>\n
The vendor, Zohocorp, has released a patch that addresses this vulnerability<\/a>. As such, users of the affected software versions are urged to apply the patch as soon as possible. For temporary mitigation, users can employ Web Application Firewalls (WAFs) or Intrusion Detection Systems (IDS) to detect and block SQL injection<\/a> attempts. However, these measures are not long-term solutions and should be followed by patch application.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The IT world has been alerted to yet another security vulnerability, this time within Zohocorp ManageEngine ADAudit Plus software. As CVE-2025-36528, this vulnerability constitutes a significant threat to the safety and privacy of data stored within organizations utilizing versions 8510 and prior of the ADAudit Plus product. In essence, this vulnerability opens the door […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[74],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-52102","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-sql-injection"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t