CVE-2024-5467 Overview
CVE-2024-5467 is an authenticated SQL injection vulnerability in Zohocorp ManageEngine ADAudit Plus. The flaw affects all builds below 8121 and resides in the account lockout report functionality. An authenticated attacker can inject arbitrary SQL statements through user-controlled parameters processed by the reporting module. Successful exploitation compromises the confidentiality, integrity, and availability of the underlying audit database. ManageEngine addressed the issue in build 8121 and published a dedicated advisory covering affected versions and remediation.
Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the ADAudit Plus database, exposing directory audit data, tampering with records, and potentially escalating access within the Active Directory monitoring environment.
Affected Products
- ManageEngine ADAudit Plus build 8100
- ManageEngine ADAudit Plus build 8110
- ManageEngine ADAudit Plus build 8120 and all prior builds below 8121
Discovery Timeline
- 2024-08-23 - CVE-2024-5467 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-5467
Vulnerability Analysis
CVE-2024-5467 is a SQL injection weakness classified under [CWE-89]. The defect lives in the account lockout report component of ADAudit Plus. This report accepts user-supplied filter parameters that are concatenated into database queries without sufficient parameterization or input sanitization. An attacker with valid application credentials can craft malicious input that alters the intended SQL statement. The resulting query executes with the privileges of the ADAudit Plus service account, which typically has broad access to the audit repository.
ADAudit Plus centralizes Active Directory change auditing, so the impacted database stores sensitive telemetry including user activity, group changes, logon events, and privileged operations. Exploitation can therefore expose forensic evidence, disable audit trails, or introduce fabricated records that mislead incident response.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command. Parameters supplied to the account lockout report are placed directly into query strings rather than bound through prepared statements. The application also fails to enforce strict server-side allowlists on report filter values, allowing SQL metacharacters to reach the database layer intact.
Attack Vector
An attacker must first authenticate to the ADAudit Plus web console. Any account permitted to view or generate the account lockout report is sufficient because privileges required are low. The attacker then submits crafted parameters through the reporting workflow. The malicious payload is appended to the backend query, and the database engine executes the attacker-controlled SQL. Exploitation occurs remotely over the network without user interaction.
No public proof-of-concept exploit code was available in the referenced sources at the time of writing. For technical specifics, see the ManageEngine CVE-2024-5467 Advisory.
Detection Methods for CVE-2024-5467
Indicators of Compromise
- Unexpected SQL syntax fragments such as UNION SELECT, --, ;, or CHAR( appearing in ADAudit Plus web request logs targeting account lockout report endpoints.
- Report generation requests originating from low-privilege accounts at unusual times or from atypical source addresses.
- Database error messages or timeouts in ADAudit Plus server logs correlated with report requests.
- Anomalous read volume against the audit database tables that store lockout, logon, and user activity data.
Detection Strategies
- Inspect HTTP request parameters submitted to the account lockout report URL for SQL metacharacters and encoded payloads.
- Correlate authenticated user sessions with database query patterns to identify a single session issuing large volumes of read-heavy or schema-enumeration queries.
- Deploy web application firewall signatures tuned for SQL injection payloads on the ADAudit Plus management interface.
Monitoring Recommendations
- Forward ADAudit Plus application logs and IIS or bundled web server logs to a centralized analytics platform for query and anomaly detection.
- Enable database-level audit logging on the ADAudit Plus backend to record query text, source, and duration.
- Alert on ADAudit Plus service account activity that deviates from the baseline of scheduled report jobs.
How to Mitigate CVE-2024-5467
Immediate Actions Required
- Upgrade ADAudit Plus to build 8121 or later using the vendor-supplied service pack.
- Rotate credentials for any accounts that authenticated to vulnerable builds, prioritizing administrative and service accounts.
- Restrict access to the ADAudit Plus web console to trusted management networks and enforce multi-factor authentication.
- Review report and query logs for the account lockout report since the affected builds were deployed.
Patch Information
Zohocorp released a fix in ManageEngine ADAudit Plus build 8121. Administrators should download the latest service pack from the vendor portal and apply it following the upgrade instructions in the ManageEngine CVE-2024-5467 Advisory. Verify the build number in the console after upgrading to confirm remediation.
Workarounds
- If immediate patching is not possible, restrict the account lockout report to a minimal set of trusted administrator accounts.
- Place ADAudit Plus behind a web application firewall configured to block SQL injection payloads on report endpoints.
- Segment the ADAudit Plus server and its database from general user networks to limit exposure until the upgrade is complete.
# Verify installed ADAudit Plus build after upgrade (Windows PowerShell)
Get-Content "C:\ManageEngine\ADAudit Plus\build.txt"
# Expected output: build number 8121 or higher
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
