Listen to this Post
How the CVE Works
CVE-2025-41407 is a SQL injection vulnerability in Zoho Corp’s ManageEngine ADAudit Plus versions below 8511. The flaw exists in the OU History report feature, where improper input validation allows attackers to inject malicious SQL queries. This can lead to unauthorized database access, data exfiltration, or remote code execution. The attack vector is network-based, requiring low complexity with no privileges, and exploits occur via crafted HTTP requests.
DailyCVE Form
Platform: ManageEngine ADAudit Plus
Version: < 8511
Vulnerability: SQL Injection
Severity: Critical
Date: 06/16/2025
Prediction: Patch expected by 07/10/2025
What Undercode Say
Analytics:
SELECT FROM OU_History WHERE param='malicious_input';
POST /reports/OUHistory HTTP/1.1 Host: target Content-Type: application/x-www-form-urlencoded ouID=1' OR 1=1--
How Exploit:
Craft HTTP requests with SQL payloads targeting the OU History endpoint.
Protection from this CVE:
Update to version 8511+.
Impact:
Data breach, RCE.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
