CVE-2024-0253: ManageEngine ADAudit Plus SQLi Vulnerability

CVE-2024-0253 Overview

CVE-2024-0253 is an authenticated SQL injection vulnerability affecting Zoho ManageEngine ADAudit Plus versions 7270 and below. The flaw resides in the home Graph-Data component and allows authenticated attackers to inject arbitrary SQL statements into backend database queries. Successful exploitation compromises the confidentiality, integrity, and availability of the ADAudit Plus database. Zoho addressed the issue in build 7271 and published a dedicated SQLFix advisory. The weakness is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers can execute arbitrary SQL against the ADAudit Plus database, exposing Active Directory audit data and potentially enabling lateral movement into monitored domain assets.

Affected Products

Zoho ManageEngine ADAudit Plus builds 7200 through 7270
Zoho ManageEngine ADAudit Plus version branch 7.2 (all builds up to and including 7270)
Any ADAudit Plus deployment auditing Active Directory, Azure AD, file servers, or Windows servers on affected builds

Discovery Timeline

2024-02-02 - CVE-2024-0253 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0253

Vulnerability Analysis

The vulnerability resides in the home Graph-Data functionality of ADAudit Plus. This component renders dashboard graphs by issuing SQL queries derived from user-supplied HTTP parameters. Input passed to the Graph-Data handler is concatenated into SQL statements without proper parameterization or sanitization.

An authenticated user with access to the ADAudit Plus web console can manipulate query parameters to break out of the intended SQL context. The injected payload executes with the privileges of the ADAudit Plus database service account, granting broad access to audit records and system tables. Because ADAudit Plus stores Active Directory change events, logon activity, and privileged operations, extracted data offers immediate reconnaissance value to an attacker.

Root Cause

The root cause is missing input neutralization in the Graph-Data query construction path [CWE-89]. Parameters that should be treated strictly as data are interpolated directly into SQL statements. Prepared statements or strict allowlist validation would prevent the attacker-controlled input from altering query semantics.

Attack Vector

Exploitation requires network access to the ADAudit Plus web interface and valid authenticated credentials. The attacker submits crafted HTTP requests to the Graph-Data endpoint containing SQL metacharacters and injected clauses. No user interaction is required beyond the attacker session. Given that ADAudit Plus is commonly deployed alongside domain infrastructure, a compromised low-privilege console account can be pivoted into full audit database disclosure. Refer to the ManageEngine SQLFix Advisory for the vendor's technical description.

Detection Methods for CVE-2024-0253

Indicators of Compromise

Unusual HTTP requests to ADAudit Plus Graph-Data endpoints containing SQL keywords such as UNION, SELECT, SLEEP, WAITFOR, or encoded quote characters.
Unexpected authenticated sessions from service accounts or read-only operator accounts issuing dashboard queries at abnormal frequency.
Database error messages or long-duration query patterns logged by the ADAudit Plus backend during dashboard rendering.
Outbound connections from the ADAudit Plus server to attacker-controlled hosts following console access.

Detection Strategies

Inspect ADAudit Plus IIS or Apache Tomcat access logs for Graph-Data URIs with suspicious query string content or oversized parameters.
Enable database auditing on the ADAudit Plus backend and alert on queries containing stacked statements or system table access originating from the application service account.
Correlate web console authentication events with subsequent Graph-Data requests to identify low-privilege accounts performing SQL-heavy dashboard activity.
Deploy web application firewall rules that match common SQL injection payload patterns targeting /adaudit or Graph-Data URIs.

Monitoring Recommendations

Forward ADAudit Plus application, access, and database logs to a centralized SIEM for retention and correlation with domain controller telemetry.
Monitor the ADAudit Plus host for anomalous child processes spawned by the Java service, which may indicate post-exploitation activity.
Track configuration changes and new local accounts on the ADAudit Plus server, as attackers commonly establish persistence after database compromise.

How to Mitigate CVE-2024-0253

Immediate Actions Required

Upgrade ADAudit Plus to build 7271 or later using the vendor-supplied SQLFix package.
Restrict network access to the ADAudit Plus web console to trusted administrative networks and jump hosts only.
Rotate credentials for all ADAudit Plus console accounts and audit recent logons for unauthorized use.
Review the ADAudit Plus backend database for unexpected schema changes, new users, or data exfiltration artifacts.

Patch Information

Zoho released build 7271 addressing CVE-2024-0253. Administrators must apply the SQLFix patch documented in the ManageEngine SQLFix Advisory. The patch replaces vulnerable Graph-Data query construction with parameterized statements. After patching, verify the installed build via the ADAudit Plus About page.

Workarounds

If immediate patching is not feasible, block external access to the ADAudit Plus console and require VPN plus multi-factor authentication for administrative access.
Reduce the number of authenticated console accounts and remove any operator accounts that are not strictly required.
Apply strict web application firewall signatures for SQL injection targeting the ADAudit Plus URI space until the upgrade to build 7271 is complete.

bash

# Verify the currently installed ADAudit Plus build after applying SQLFix
type "C:\ManageEngine\ADAudit Plus\version.txt"

# Confirmed fixed build:
# ADAudit Plus 7271 or later