CVE-2024-49574: ManageEngine ADAudit Plus SQLi Flaw

CVE-2024-49574 Overview

CVE-2024-49574 is a SQL injection vulnerability affecting Zohocorp ManageEngine ADAudit Plus versions below 8123. The flaw resides in the reports module and allows an authenticated attacker to inject arbitrary SQL statements through crafted requests. Successful exploitation can lead to unauthorized data access, modification of audit records, and impact to the availability of the ADAudit Plus service. The weakness is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). ManageEngine has published a security advisory and a fixed build addressing the issue.

Critical Impact
Authenticated attackers can execute arbitrary SQL against the ADAudit Plus backend, exposing sensitive Active Directory audit data and enabling tampering with stored records.

Affected Products

Zohocorp ManageEngine ADAudit Plus versions prior to build 8123
ManageEngine ADAudit Plus 8.1 builds 8100, 8110, 8120, 8121
Reports module component of ADAudit Plus

Discovery Timeline

2024-11-18 - CVE-2024-49574 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-49574

Vulnerability Analysis

The vulnerability is a SQL injection flaw located in the reports module of ManageEngine ADAudit Plus. User-supplied input consumed by report generation endpoints reaches SQL query construction without sufficient neutralization. An attacker with valid low-privilege credentials to the ADAudit Plus web console can submit crafted parameters that alter the intended query logic.

Once injected, the attacker can read arbitrary tables in the ADAudit Plus database, including stored Active Directory audit events, configuration data, and potentially credential material used by the product. The attacker can also modify or delete records, which is relevant because ADAudit Plus is often relied upon as the authoritative audit trail for Active Directory changes. Impact extends to availability, as malformed queries can crash worker threads or exhaust database resources.

ADAudit Plus is a widely deployed identity monitoring product, so exploitation directly undermines defensive telemetry that security teams use to detect Active Directory attacks. Tampered audit records may allow adjacent intrusions to go unseen.

Root Cause

The root cause is improper neutralization of special elements in SQL statements (CWE-89) within reporting endpoints. Input parameters are concatenated or interpolated into database queries rather than bound as parameters, allowing metacharacters to change query semantics.

Attack Vector

The attack vector is network-based against the ADAudit Plus web interface and requires authentication at low privilege. No user interaction is needed. An attacker who obtains any valid operator account, or leverages a preexisting foothold in the environment to reach the console, can send crafted HTTP requests to the vulnerable reports endpoint. Exploitation does not require console access to the underlying server. Refer to the ManageEngine CVE-2024-49574 Advisory for vendor-supplied technical detail.

Detection Methods for CVE-2024-49574

Indicators of Compromise

HTTP requests to ADAudit Plus reports endpoints containing SQL metacharacters such as single quotes, UNION SELECT, --, /*, or stacked queries in parameter values.
Unexpected database errors or long-running queries originating from the ADAudit Plus application account in PostgreSQL or MSSQL logs.
Report generation requests from accounts that do not normally run reports, or from unusual source IP ranges.

Detection Strategies

Inspect ADAudit Plus access logs under the product installation directory for anomalous parameter values on report-related URLs.
Enable database query logging on the backend and alert on SQL syntax errors or queries referencing system tables such as pg_catalog or information_schema.
Correlate authenticated web sessions with sudden spikes in database read volume from the ADAudit Plus service account.

Monitoring Recommendations

Forward ADAudit Plus web server, application, and database logs to a centralized log platform for retention and query.
Monitor for build version changes on ADAudit Plus servers to confirm patch state remains at 8123 or later.
Alert on new low-privilege operator accounts created within ADAudit Plus, which could be used to reach the vulnerable endpoint.

How to Mitigate CVE-2024-49574

Immediate Actions Required

Upgrade ManageEngine ADAudit Plus to build 8123 or later using the vendor-supplied service pack.
Restrict network access to the ADAudit Plus console so it is reachable only from administrative subnets or through a reverse proxy that enforces authentication.
Rotate credentials for all ADAudit Plus operator and administrator accounts after patching, particularly if the console was previously exposed.
Review audit records for the period preceding the patch for evidence of tampering or unusual report activity.

Patch Information

Zohocorp has released a fixed build of ADAudit Plus that addresses CVE-2024-49574. Administrators should apply build 8123 or higher as documented in the ManageEngine CVE-2024-49574 Advisory. The service pack is available from the ManageEngine customer portal and can be installed over existing deployments after taking a database backup.

Workarounds

No vendor-supplied workaround replaces the patch; upgrading to build 8123 or later is the required remediation.
As an interim compensating control, limit console access with network segmentation and enforce multi-factor authentication for all ADAudit Plus accounts to reduce the attacker population able to reach the vulnerable endpoint.
Remove or disable unused operator accounts to shrink the authenticated attack surface.

bash

# Verify installed ADAudit Plus build after upgrade (Windows)
type "%ADAP_HOME%\bin\version.txt"

# Example firewall restriction limiting console access to an admin subnet
netsh advfirewall firewall add rule name="ADAudit Plus Console" ^
  dir=in action=allow protocol=TCP localport=8081 ^
  remoteip=10.10.20.0/24