Minhgalaxy

An authenticated SQL injection issue exists in the ADAudit Plus Reports API. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to or manipulation of the database.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. An attacker can inject arbitrary web scripts through the IPN endpoint using the `rel` and `option` parameters. Because the endpoint lacks authentication, nonce validation, or signature verification, malicious payloads are stored and subsequently executed when an administrator views the settlement error log.

The issue is related to SQL injection while exporting reports.

The issue concerns an authenticated SQL injection in the logon events aggregate report.

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine Exchange Reporter Plus versions before 5715 Description: The issue is related to SQL Injection in the reports module of the software. This allows for potential exploitation. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. Recommendations: For versions before 5715, update to a version 5715 or later to resolve the SQL Injection issue in the reports module. As a temporary workaround, consider restricting access to the reports module until a patch is available.

The issue concerns an authenticated SQL injection vulnerability in the file summary option. This vulnerability affects Zohocorp ManageEngine ADAudit Plus.

The issue is related to an authenticated SQL injection in the dashboard of ADAudit Plus. This vulnerability is distinct from another issue affecting the same dashboard.

The issue is related to an authenticated SQL injection in the dashboard of Zohocorp ManageEngine ADAudit Plus. This vulnerability is distinct from another issue affecting the same dashboard.

The issue concerns an authenticated SQL injection vulnerability in the alerts module. This vulnerability affects versions of Zohocorp ManageEngine ADAudit Plus below 8000.

The issue concerns an authenticated SQL injection vulnerability in the account lockout report of Zohocorp ManageEngine ADAudit Plus. This vulnerability allows for malicious SQL code execution, potentially leading to unauthorized access or data manipulation.

The issue concerns an authenticated SQL injection vulnerability in the aggregate reports option. This vulnerability can be exploited by authenticated users, potentially leading to unauthorized access or manipulation of data.

The issue concerns an authenticated SQL injection in the reports module.

The issue concerns an authenticated SQL injection vulnerability in the extranet lockouts report option. This vulnerability can be exploited by authenticated users, potentially leading to unauthorized access or data manipulation. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue is related to an authenticated SQL Injection vulnerability in user session recording.

The issue concerns an authenticated SQL Injection vulnerability in the aggregate reports' search option. This allows attackers to inject malicious SQL code, potentially leading to unauthorized access or data manipulation.

The issue is related to the lack of protection against SQL query structure attacks in the reports module of ManageEngine Exchange Reporter Plus. This can allow a remote attacker to execute arbitrary SQL queries to the database. The exploitation of this issue is possible through authenticated SQL injection in the reports module.

The issue allows SQL Injection while getting aggregate report data.

The issue allows SQL injection in the dashboard graph feature. This could potentially lead to remote attacks and data compromise.

The issue allows SQL injection while adding file shares. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue allows SQL injection in the aggregate reports search option. This could potentially be exploited to extract or modify sensitive data.