SQL Injection

Vulnerability

ManageEngine Password Manager Pro versions before 12431 and ManageEngine PAM360 versions before 7001 are vulnerable to an authenticated SQL injection vulnerability via the global search option [1]. An attacker with valid credentials can exploit this flaw by sending specially crafted input to the search functionality, allowing the execution of arbitrary SQL queries against the database.

Exploitation

Exploitation requires valid credentials for the application [1]. The attack is carried out by injecting malicious SQL code into the global search field. The injected query is executed by the database backend without proper sanitization.

Impact

This vulnerability allows an adversary to execute custom SQL queries and access database table entries [1]. However, due to dual encryption mechanisms, access to sensitive information such as passwords remains restricted [1].

Mitigation

The vulnerability is fixed in Password Manager Pro build 12431 and PAM360 build 7001, released on 14 June 2024 [1]. Users are strongly advised to upgrade immediately. No workarounds are available.