Listen to this Post
How the CVE Works
CVE-2025-36528 is an authenticated SQL injection vulnerability in ManageEngine ADAudit Plus (versions 8510 and prior). Attackers with valid credentials can exploit improper input sanitization in the Service Account Auditing reports feature. Malicious SQL queries are injected through crafted input, allowing unauthorized database access, data exfiltration, or command execution. The flaw stems from insufficient validation of user-supplied parameters in report-generation functions.
DailyCVE Form
Platform: ManageEngine ADAudit Plus
Version: ≤ 8510
Vulnerability: SQL Injection
Severity: Critical
Date: 06/16/2025
Prediction: Patch expected by 07/15/2025
What Undercode Say
SELECT FROM service_accounts WHERE account_id = '1' UNION SELECT 1,2,3--';
payload = f"/reports/generate?param=1' AND 1=CONVERT(int,(SELECT table_name FROM information_schema.tables))--"
How Exploit
1. Authenticate with compromised credentials.
- Inject SQL via Service Account Auditing report parameters.
3. Extract database contents or execute commands.
Protection from this CVE
1. Apply vendor patch immediately.
2. Restrict database permissions.
3. Use WAF to filter SQLi patterns.
Impact
- Unauthorized data access.
- Remote code execution.
- Full system compromise.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
