CVE-2024-5586: ManageEngine ADAudit Plus SQLi Vulnerability

CVE-2024-5586 Overview

CVE-2024-5586 is an authenticated SQL injection vulnerability in Zohocorp ManageEngine ADAudit Plus versions below 8121. The flaw resides in the extranet lockouts report option and allows an authenticated attacker to inject arbitrary SQL statements into backend database queries. Successful exploitation can compromise confidentiality, integrity, and availability of the audit database. The weakness is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Zohocorp addressed the issue in build 8121 and published a dedicated advisory for administrators.

Critical Impact
An authenticated network attacker can execute arbitrary SQL queries against the ADAudit Plus database, potentially exposing Active Directory audit data and enabling further compromise of the identity monitoring stack.

Affected Products

Zohocorp ManageEngine ADAudit Plus version 8.1 build 8100
Zohocorp ManageEngine ADAudit Plus version 8.1 build 8110
Zohocorp ManageEngine ADAudit Plus version 8.1 build 8120

Discovery Timeline

2024-08-23 - CVE-2024-5586 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5586

Vulnerability Analysis

The vulnerability is an authenticated SQL injection in the extranet lockouts report feature of ManageEngine ADAudit Plus. An authenticated user supplies attacker-controlled input that is concatenated into a SQL query without adequate parameterization or sanitization. The database engine then executes the tainted statement with the privileges of the ADAudit Plus service account.

Because ADAudit Plus stores Active Directory audit records, lockout events, and configuration data, successful injection can disclose sensitive identity telemetry. Depending on database privileges, an attacker can also modify audit trails, tamper with report data, or disrupt logging continuity. The attack requires low-privileged credentials and no user interaction, and it can be launched remotely over the network against the product's web interface.

Root Cause

The root cause is improper neutralization of special elements in SQL commands within the extranet lockouts report handler. User-supplied parameters are incorporated into SQL statements through string concatenation instead of prepared statements or a parameterized query API, which allows metacharacters and stacked query fragments to alter query structure.

Attack Vector

Exploitation requires network access to the ADAudit Plus web console and valid application credentials. The attacker submits a crafted request to the extranet lockouts report endpoint, injecting SQL payloads through the affected parameter. The backend evaluates the malicious statement, returning query results, error output, or timing-based signals the attacker can use to enumerate the database. No verified public proof-of-concept code is available at this time; refer to the ManageEngine CVE-2024-5586 Advisory for vendor-supplied technical guidance.

Detection Methods for CVE-2024-5586

Indicators of Compromise

Unexpected HTTP requests to the ADAudit Plus extranet lockouts report endpoint containing SQL metacharacters such as single quotes, UNION, SELECT, --, or ;
Anomalous database errors or long-running queries originating from the ADAudit Plus service account
Report generation activity from low-privileged accounts that do not normally access the extranet lockouts report

Detection Strategies

Inspect ADAudit Plus web-access logs for parameter values containing SQL keywords or encoded payloads targeting the extranet lockouts report
Correlate authenticated web sessions with database query logs to identify statements that deviate from application-generated query patterns
Alert on outbound data volume spikes from the ADAudit Plus host that suggest bulk extraction from the audit database

Monitoring Recommendations

Enable verbose application and database logging on ADAudit Plus servers and forward logs to a centralized analytics platform
Baseline normal report usage per user and flag deviations, especially from service or read-only accounts
Monitor for privilege changes and new local accounts on hosts running ADAudit Plus following any suspicious report activity

How to Mitigate CVE-2024-5586

Immediate Actions Required

Upgrade ManageEngine ADAudit Plus to build 8121 or later without delay
Rotate credentials for all ADAudit Plus application users, particularly any account with report generation privileges
Review audit logs for evidence of unauthorized report access or database errors dating back to the deployment of any affected build

Patch Information

Zohocorp released a fixed build in ManageEngine ADAudit Plus version 8121. Administrators should follow the upgrade steps in the ManageEngine CVE-2024-5586 Advisory and validate that the running build reports 8121 or higher after the update.

Workarounds

Restrict network access to the ADAudit Plus web console to trusted administrative subnets until the patch is applied
Enforce least-privilege role assignments so that only required personnel can generate the extranet lockouts report
Require multi-factor authentication for all ADAudit Plus accounts to reduce the risk of credential-based abuse

bash

# Verify installed ADAudit Plus build after upgrade (Windows PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\WOW6432Node\ZOHO Corp\ManageEngine ADAudit Plus" |
  Select-Object DisplayName, DisplayVersion, BuildNumber