CVE-2024-36035: ManageEngine ADAudit Plus SQLi Vulnerability

CVE-2024-36035 Overview

CVE-2024-36035 is an authenticated SQL Injection vulnerability affecting Zohocorp ManageEngine ADAudit Plus versions below build 8003. The flaw exists in the user session recording component and allows an authenticated attacker to inject arbitrary SQL statements into backend database queries. Successful exploitation compromises the confidentiality, integrity, and availability of the audit database used to record Active Directory activity. The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
An authenticated attacker with low privileges can execute arbitrary SQL queries against the ADAudit Plus database, exposing Active Directory audit data and potentially enabling further compromise of the auditing infrastructure.

Affected Products

Zohocorp ManageEngine ADAudit Plus version 8.0 (base release)
Zohocorp ManageEngine ADAudit Plus builds 8000, 8001, and 8002
All Zohocorp ManageEngine ADAudit Plus versions below build 8003

Discovery Timeline

2024-08-12 - CVE-2024-36035 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-36035

Vulnerability Analysis

ManageEngine ADAudit Plus is an Active Directory auditing and change-monitoring platform. The vulnerability resides in the user session recording feature, which stores and retrieves session data through database queries. Input parameters passed to this component are concatenated into SQL statements without proper sanitization or parameterization.

An attacker holding a valid low-privileged application account can craft input that alters the structure of the underlying SQL query. This gives the attacker the ability to read arbitrary tables, modify audit records, or trigger database-level operations. Because ADAudit Plus stores Active Directory event data, extracted records may include user activity, group membership changes, and authentication events.

Root Cause

The root cause is improper neutralization of special SQL characters in user-supplied input handled by the session recording feature. The affected code path constructs SQL statements using unsanitized values rather than parameterized queries or prepared statements, which is the class of defect described by CWE-89.

Attack Vector

Exploitation requires network access to the ADAudit Plus web interface and valid authenticated credentials. The attacker submits malicious payloads through the session recording functionality, embedding SQL syntax within request parameters. User interaction is not required. No verified public proof-of-concept or exploit code is currently available.

The vulnerability mechanism is described in the ManageEngine SQLFix Advisory. Verified exploitation code is not published, and this article does not include synthetic payloads.

Detection Methods for CVE-2024-36035

Indicators of Compromise

Unexpected SQL error messages, stack traces, or database exceptions logged by ADAudit Plus during session recording activity.
Anomalous outbound queries from the ADAudit Plus service account to database tables outside the normal session recording scope.
Authenticated ADAudit Plus sessions issuing repeated requests containing SQL metacharacters such as single quotes, UNION, SELECT, or comment sequences.
Unexplained modifications to audit tables or unexpected new database users created by the ADAudit Plus service account.

Detection Strategies

Inspect ADAudit Plus web server logs for HTTP requests targeting session recording endpoints with SQL syntax in parameter values.
Correlate authentication events with SQL error volume; a spike in database errors tied to a single authenticated user is a strong signal.
Deploy web application firewall (WAF) rules that identify SQL injection patterns against the ADAudit Plus URL namespace.

Monitoring Recommendations

Monitor the ADAudit Plus database for unexpected schema queries, information_schema access, or bulk data reads from the service account.
Alert on ADAudit Plus process behavior that deviates from baseline, including new outbound network connections or spawned child processes.
Track logins to the ADAudit Plus console from unusual geographies or off-hours accounts, as authentication is a prerequisite for exploitation.

How to Mitigate CVE-2024-36035

Immediate Actions Required

Upgrade ADAudit Plus to build 8003 or later using the ManageEngine SQLFix Advisory.
Rotate credentials for all ADAudit Plus application accounts, especially any low-privileged accounts that may have been abused.
Review the ADAudit Plus database for signs of unauthorized queries, schema enumeration, or modified audit records.
Restrict network access to the ADAudit Plus console to trusted administrative networks and jump hosts.

Patch Information

Zohocorp addressed CVE-2024-36035 in ManageEngine ADAudit Plus build 8003. Administrators should apply the fix documented in the ManageEngine SQLFix Advisory. All builds prior to 8003, including 8000, 8001, and 8002, remain vulnerable.

Workarounds

Enforce strong authentication and multi-factor authentication on ADAudit Plus console accounts to reduce the pool of attackers who can meet the authenticated precondition.
Place the ADAudit Plus console behind a reverse proxy or WAF configured with SQL injection signatures until the patch is applied.
Run the ADAudit Plus database service account with least privilege, denying access to tables and schemas outside its required scope.
Audit and remove unused or dormant ADAudit Plus user accounts to shrink the attack surface.

bash

# Verify installed ADAudit Plus build after applying the SQLFix update
# Windows PowerShell against the ADAudit Plus install directory
Get-Content "C:\ManageEngine\ADAudit Plus\bin\version.txt"

# Expected output should indicate build 8003 or later