CVE-2023-48792
Published: 02 February 2024
Summary
CVE-2023-48792 is a critical-severity SQL Injection (CWE-89) vulnerability in Zohocorp Manageengine Adaudit Plus. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 7.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Zoho ManageEngine ADAudit Plus through version 7250 contains a SQL injection vulnerability in the report export option, tracked as CVE-2023-48792 and assigned CWE-89. The flaw carries a CVSS 3.1 base score of 9.8, reflecting network-accessible attack vectors that require no authentication or user interaction and result in complete loss of confidentiality, integrity, and availability.
An unauthenticated remote attacker can supply crafted input to the export functionality to execute arbitrary SQL commands against the underlying database, enabling data exfiltration, modification, or deletion as well as potential lateral movement within the monitored Active Directory environment.
Vendor references direct administrators to a SQL injection fix released in build 7271, available via the ManageEngine ADAudit Plus download and support pages; applying this update is presented as the primary remediation step.
The associated EPSS score has remained flat at 0.0862 with no documented rise after disclosure and no public reports of in-the-wild exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-52825
Vulnerability details
Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.