CVE-2024-36034 Overview
CVE-2024-36034 is an authenticated SQL injection vulnerability in Zohocorp ManageEngine ADAudit Plus versions below 8003. The flaw resides in the search option of aggregate reports, where user-supplied input is passed into database queries without proper sanitization. An authenticated attacker with low privileges can inject arbitrary SQL statements against the backend database. Successful exploitation compromises confidentiality, integrity, and availability of audit data. The vulnerability is tracked under CWE-89 and has an EPSS score in the 93rd percentile, indicating elevated exploitation likelihood relative to other CVEs.
Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the ADAudit Plus database, exposing Active Directory audit data and enabling potential privilege escalation.
Affected Products
- Zohocorp ManageEngine ADAudit Plus version 8.0 build 8000
- Zohocorp ManageEngine ADAudit Plus version 8.0 build 8001
- Zohocorp ManageEngine ADAudit Plus version 8.0 build 8002
Discovery Timeline
- 2024-08-12 - CVE-2024-36034 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-36034
Vulnerability Analysis
ADAudit Plus generates aggregate reports summarizing Active Directory audit activity across domains. The reporting interface exposes a search option that accepts user input to filter report results. In builds below 8003, this input is concatenated into SQL statements executed against the underlying audit database. The absence of parameterized queries or input validation allows an authenticated attacker to break out of the intended query context. From there, the attacker can append UNION SELECT clauses, stacked queries, or boolean-based payloads to extract data or manipulate records. Because ADAudit Plus stores Active Directory event data, exposed rows may include user account changes, group membership modifications, and authentication events useful for further attacks.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The aggregate report search handler builds queries via string concatenation instead of prepared statements, allowing metacharacters such as single quotes and semicolons to alter query structure.
Attack Vector
Exploitation requires network access to the ADAudit Plus web console and valid low-privilege credentials. The attacker submits a crafted search parameter through the aggregate reports feature. No user interaction is required beyond the attacker's own authenticated session. The vulnerability manifests server-side within the report query pipeline. See the ManageEngine SQLFix Advisory for vendor-provided technical context.
No verified public proof-of-concept code is available for CVE-2024-36034. Refer to the vendor advisory for remediation guidance.
Detection Methods for CVE-2024-36034
Indicators of Compromise
- Unexpected SQL error messages, stack traces, or long-running queries logged by the ADAudit Plus application server.
- HTTP requests to aggregate report endpoints containing SQL metacharacters such as ', --, ;, UNION, or SLEEP(.
- Authenticated sessions from low-privilege accounts issuing repeated report searches with abnormal parameter lengths.
Detection Strategies
- Inspect ADAudit Plus web access logs for request parameters targeting aggregate report search functionality with SQL syntax patterns.
- Correlate authenticated user activity with database query volume to identify anomalous read patterns against audit tables.
- Deploy a web application firewall (WAF) rule set that flags SQL injection signatures on ADAudit Plus URIs.
Monitoring Recommendations
- Enable verbose query logging on the ADAudit Plus backend database and forward logs to a centralized SIEM.
- Alert on ADAudit Plus service accounts issuing queries outside the application's normal statement fingerprints.
- Track authentication events for ADAudit Plus operator accounts and flag logins from unusual source addresses.
How to Mitigate CVE-2024-36034
Immediate Actions Required
- Upgrade ADAudit Plus to build 8003 or later as published in the ManageEngine SQLFix Advisory.
- Rotate credentials for any ADAudit Plus operator accounts that may have been exposed prior to patching.
- Restrict console access to trusted management networks and enforce multi-factor authentication for all operator roles.
Patch Information
Zohocorp released build 8003 addressing this SQL injection in the aggregate reports search option. Administrators should download and apply the service pack from the vendor portal referenced in the ManageEngine SQLFix Advisory. Verify the upgrade by checking the build number under the About page after installation.
Workarounds
- Limit ADAudit Plus web console access to a management VLAN or VPN until the patch is applied.
- Review and reduce operator role assignments so fewer accounts can reach the aggregate reports feature.
- Deploy WAF signatures blocking SQL metacharacters on ADAudit Plus report endpoints as a compensating control.
# Verify installed ADAudit Plus build after patching
grep -i "build" /opt/ManageEngine/ADAuditPlus/conf/product.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
