CVE-2025-36528: ManageEngine ADAudit Plus SQLi Vulnerability

CVE-2025-36528 Overview

CVE-2025-36528 is an authenticated SQL injection vulnerability in Zohocorp ManageEngine ADAudit Plus versions 8510 and prior. The flaw resides in the Service Account Auditing reports component. An authenticated attacker can inject crafted SQL statements through report parameters to manipulate backend database queries. The weakness is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

Authenticated attackers can execute arbitrary SQL against the ADAudit Plus database, exposing Active Directory audit data, credentials, and configuration information across the monitored domain.

Affected Products

• Zohocorp ManageEngine ADAudit Plus versions up to and including build 8510
• ManageEngine ADAudit Plus 8.5 (build 8500)
• ManageEngine ADAudit Plus 8.5 (build 8510)

Discovery Timeline

• 2025-06-09 - CVE-2025-36528 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36528

Vulnerability Analysis

The vulnerability exists in the Service Account Auditing reports feature of ADAudit Plus. The reporting module accepts user-supplied parameters that are concatenated into SQL queries without proper parameterization or sanitization. An authenticated user with access to the reporting interface can craft input that breaks out of the intended query context. The product operates as a privileged Active Directory monitoring service, so successful exploitation grants access to highly sensitive audit data.

The attack proceeds over the network against the ADAudit Plus web console. Exploitation requires valid authentication credentials but no user interaction. Confidentiality and integrity of the underlying database are at significant risk, with availability impacted to a lesser degree.

Root Cause

The root cause is improper neutralization of special characters in SQL statements [CWE-89]. The Service Account Auditing reports endpoint constructs database queries by concatenating request parameters directly into SQL strings rather than using parameterized queries or prepared statements. This allows attacker-controlled input to alter the query syntax and execute attacker-defined SQL.

Attack Vector

An authenticated attacker submits a manipulated request to the Service Account Auditing reports endpoint with malicious SQL payloads in vulnerable parameters. The injected SQL is executed by the backend database engine in the context of the ADAudit Plus service account. Attackers can extract audit logs, enumerate database schemas, read stored credentials and tokens, modify records, or use database functions to pivot deeper into the environment.

No verified public proof-of-concept code is available. See the ManageEngine CVE-2025-36528 Advisory for vendor technical details.

Detection Methods for CVE-2025-36528

Indicators of Compromise

• Unusual or malformed query parameters submitted to Service Account Auditing report URLs in ADAudit Plus web access logs
• Database errors or stack traces correlated with reporting endpoint requests
• Unexpected outbound queries or large result-set retrievals originating from the ADAudit Plus service account
• Authenticated sessions executing report requests outside of normal business hours or from atypical source IPs

Detection Strategies

• Inspect ADAudit Plus access logs for SQL meta-characters such as single quotes, UNION, SELECT, --, and /* inside Service Account Auditing report parameters
• Enable database auditing on the ADAudit Plus backend to flag queries that deviate from known report templates
• Correlate authenticated session activity with anomalous query volumes or schema enumeration patterns

Monitoring Recommendations

• Forward ADAudit Plus application and database logs to a centralized SIEM for retention and correlation
• Alert on repeated 500-class HTTP responses from reporting endpoints, which often indicate injection probing
• Monitor the ADAudit Plus service account for unexpected lateral activity within the Active Directory environment

How to Mitigate CVE-2025-36528

Immediate Actions Required

• Upgrade ADAudit Plus to a build later than 8510 as published by Zohocorp
• Restrict access to the ADAudit Plus web console to trusted administrative networks only
• Audit existing accounts and revoke reporting privileges for users who do not require them
• Rotate credentials and service account secrets stored or referenced by ADAudit Plus following patching

Patch Information

Zohocorp has released a fixed build addressing the SQL injection in the Service Account Auditing reports module. Apply the updated build referenced in the ManageEngine CVE-2025-36528 Advisory. Verify the running build via the product About page after upgrading.

Workarounds

• Limit access to Service Account Auditing reports to a minimum set of trusted administrators until the patch is applied
• Place ADAudit Plus behind a reverse proxy or web application firewall configured to block SQL injection patterns on report endpoints
• Enforce multi-factor authentication on all ADAudit Plus accounts to raise the bar for credential misuse

# Verify ADAudit Plus build after patching (Windows install path)
type "C:\ManageEngine\ADAudit Plus\bin\version.txt"

# Restrict console access at the host firewall to an admin subnet
netsh advfirewall firewall add rule name="ADAuditPlus-Admin-Only" ^
  dir=in action=allow protocol=TCP localport=8081 remoteip=10.10.10.0/24