CVE-2023-48792

An attacker can inject malicious SQL code through parameters related to the report export function in the application. Due to the lack of validation and proper query parameterization, the entered data goes directly to the database engine. The attack vector is network-based, requires no privileges or user interaction, making this vulnerability particularly dangerous.

Successful exploitation of this vulnerability may allow an attacker to perform unauthorized read, modification, or deletion of data from the application database, and depending on the environment configuration, also to execute commands at the database server level.

Zoho ManageEngine ADAudit Plus should be updated to version 7271 or later, in which the vendor introduced fixes described at: https://www.manageengine.com/products/active-directory-audit/sqlfix-7271.html

Zoho ManageEngine ADAudit Plus versions up to and including 7250.