CVE-2024-5546 Overview
CVE-2024-5546 is an authenticated SQL injection vulnerability affecting Zohocorp ManageEngine Password Manager Pro and ManageEngine PAM360. The flaw resides in the global search option and allows authenticated attackers to inject arbitrary SQL statements into backend database queries. Password Manager Pro versions before 12431 and PAM360 versions before 7001 are affected. Because these products manage privileged credentials and enterprise password vaults, successful exploitation can expose highly sensitive secrets. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated attackers can read, modify, or delete stored credentials and privileged account data, undermining the core function of the password vault.
Affected Products
- Zohocorp ManageEngine Password Manager Pro versions before build 12431
- Zohocorp ManageEngine PAM360 versions before build 7001
- All prior 4.x, 5.x, 6.x, 7.x, 8.x, 9.x, 10.x, 11.x, and 12.x branches listed in the vendor advisory
Discovery Timeline
- 2024-08-28 - CVE-2024-5546 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-5546
Vulnerability Analysis
The vulnerability is an authenticated SQL injection reachable through the global search feature in ManageEngine Password Manager Pro and PAM360. User-supplied search input is passed into a database query without adequate parameterization or sanitization. An authenticated user with low privileges can craft search terms that alter the intended SQL query structure. Because both products act as enterprise credential vaults, database compromise directly threatens confidentiality, integrity, and availability of stored secrets.
Exploitation is executed over the network against the web management interface. The attack complexity is low and no user interaction is required beyond a valid session.
Root Cause
The root cause is improper neutralization of special SQL elements in the global search parameter. The application concatenates or otherwise embeds user-controlled input into a SQL statement rather than using bound parameters or a strict allowlist. This class of defect [CWE-89] enables an attacker to modify query semantics and access data outside the intended result set.
Attack Vector
An attacker must first obtain valid credentials to the Password Manager Pro or PAM360 web console. With authenticated access, the attacker submits a crafted request to the global search endpoint containing SQL metacharacters. The malicious payload is interpreted by the database engine, permitting UNION-based extraction, boolean or time-based inference, or direct modification of records. Because the product stores privileged credentials, extracted data can be leveraged for lateral movement across the environment.
No verified public proof-of-concept code is available. Refer to the ManageEngine Security Advisory for vendor-supplied technical detail.
Detection Methods for CVE-2024-5546
Indicators of Compromise
- Web server or application logs showing global search requests containing SQL metacharacters such as ', --, UNION, SLEEP(, or information_schema references
- Unusually long or URL-encoded query strings targeting the search endpoint of Password Manager Pro or PAM360
- Database error responses returned to the client immediately following search interactions
- Authenticated sessions issuing large volumes of search requests in short intervals, consistent with automated injection tooling
Detection Strategies
- Enable and centralize Password Manager Pro and PAM360 application, access, and audit logs for correlation and anomaly analysis
- Deploy web application firewall (WAF) signatures for SQL injection patterns on the management console URLs
- Baseline normal search query length and syntax per user, and alert on statistical outliers or metacharacter-heavy payloads
- Correlate authentication events with subsequent search and database activity to identify low-privileged accounts exhibiting reconnaissance behavior
Monitoring Recommendations
- Monitor the underlying database (PostgreSQL or MS SQL) for unexpected queries against credential tables originating from the application service account
- Alert on outbound network traffic from the Password Manager Pro or PAM360 host that deviates from normal update and integration patterns
- Track privilege changes, credential access events, and vault export operations following any suspicious search activity
How to Mitigate CVE-2024-5546
Immediate Actions Required
- Upgrade ManageEngine Password Manager Pro to build 12431 or later
- Upgrade ManageEngine PAM360 to build 7001 or later
- Rotate any credentials stored in the vault if there is evidence of unauthorized search or database activity prior to patching
- Restrict network access to the Password Manager Pro and PAM360 web consoles to trusted administrative networks only
Patch Information
Zohocorp has released fixed builds addressing CVE-2024-5546. Administrators should apply Password Manager Pro build 12431 or later and PAM360 build 7001 or later. Full remediation guidance and download links are published in the ManageEngine Security Advisory.
Workarounds
- Limit user account provisioning to reduce the population of authenticated users capable of reaching the search endpoint
- Enforce multi-factor authentication on all accounts to raise the barrier for credential-based access required to trigger the flaw
- Place the management console behind a reverse proxy or WAF with SQL injection filtering until patches are applied
- Review and reduce role permissions so that non-administrative users cannot access the global search feature where feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
