CVE-2024-38871

Name of the Vulnerable Software and Affected Versions ManageEngine Exchange Reporter Plus versions 5717 and below

Description The issue is related to the lack of protection against SQL query structure attacks in the reports module of ManageEngine Exchange Reporter Plus. This can allow a remote attacker to execute arbitrary SQL queries to the database. The exploitation of this issue is possible through authenticated SQL injection in the reports module.

Recommendations For versions 5717 and below, update to a version above 5717 to resolve the issue. As a temporary workaround, consider restricting access to the reports module until a patch is available.