CVE-2025-41403: ManageEngine ADAudit Plus SQLi Flaw

CVE-2025-41403 Overview

CVE-2025-41403 is an authenticated SQL injection vulnerability in Zohocorp ManageEngine ADAudit Plus versions 8510 and prior. The flaw resides in the service account audit data retrieval functionality. An authenticated attacker can inject malicious SQL statements through this endpoint to manipulate backend database queries.

The vulnerability is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. ADAudit Plus is widely deployed for Active Directory change auditing, making compromise of its database significant for identity and access governance.

Critical Impact

Authenticated attackers can extract or modify audit data, escalate privileges within the application, and impact the integrity of Active Directory monitoring records.

Affected Products

• Zohocorp ManageEngine ADAudit Plus version 8.5 (base release)
• Zohocorp ManageEngine ADAudit Plus build 8500
• Zohocorp ManageEngine ADAudit Plus build 8510 and all prior builds

Discovery Timeline

• 2025-05-22 - CVE-2025-41403 published to NVD
• 2025-06-16 - Last updated in NVD database

Technical Details for CVE-2025-41403

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input in the code path that fetches service account audit data. Parameters supplied to this functionality are concatenated into SQL statements without parameterization or adequate sanitization. An authenticated user can therefore alter query semantics by injecting SQL syntax through the affected parameters.

Exploitation requires valid application credentials but no user interaction. The attack is delivered over the network against the ADAudit Plus web interface. Successful exploitation yields high confidentiality and integrity impact on the underlying audit database and limited availability impact.

ADAudit Plus stores sensitive Active Directory audit telemetry, including logon events, group membership changes, and service account activity. Database compromise can expose privileged account behavior and allow tampering with audit trails used for forensic and compliance purposes.

Root Cause

The root cause is the construction of SQL queries through string concatenation in the service account audit data retrieval path. The application fails to enforce prepared statements or strict input validation on attacker-controllable fields used in that query.

Attack Vector

An attacker authenticates to ADAudit Plus with any valid low-privilege account. The attacker then submits a crafted request to the service account audit data endpoint, embedding SQL payloads in vulnerable parameters. The injected SQL executes in the database context used by the application, enabling data exfiltration, modification, or further enumeration of internal records.

No verified proof-of-concept code is publicly available. Refer to the ManageEngine Security Advisory for additional technical context.

Detection Methods for CVE-2025-41403

Indicators of Compromise

• Unexpected SQL syntax tokens such as UNION, SELECT, --, or OR 1=1 in ADAudit Plus application logs and web access logs
• Anomalous query patterns or unusually long response times from the service account audit data endpoints
• Authenticated sessions issuing high volumes of requests to audit data retrieval URLs outside normal operator behavior
• Database errors or stack traces returned to the client by the ADAudit Plus web interface

Detection Strategies

• Inspect ADAudit Plus access logs for requests targeting service account audit endpoints with suspicious query string content.
• Correlate authenticated session activity with database error events to surface failed injection attempts.
• Apply web application firewall (WAF) signatures for SQL injection patterns against the ADAudit Plus front-end.

Monitoring Recommendations

• Forward ADAudit Plus application logs, IIS or Apache access logs, and the backing database audit logs to a centralized SIEM.
• Alert on authenticated users executing queries that diverge from the application's normal parameter shapes or lengths.
• Monitor for unexpected changes to audit records, service account configuration data, and ADAudit Plus user roles.

How to Mitigate CVE-2025-41403

Immediate Actions Required

• Upgrade ADAudit Plus to a fixed build above 8510 as published in the ManageEngine Security Advisory.
• Audit existing ADAudit Plus user accounts and revoke unused or shared credentials that could be abused for authenticated exploitation.
• Rotate credentials for any service accounts whose audit data may have been queried by untrusted users.
• Restrict network access to the ADAudit Plus console to administrative subnets only.

Patch Information

Zohocorp has released a fixed build above ADAudit Plus 8510. Apply the upgrade following the vendor's instructions in the ManageEngine Security Advisory for CVE-2025-41403. After patching, validate the installed build number through the product console.

Workarounds

• Limit ADAudit Plus login access to a small set of trusted administrators until the patch is applied.
• Place the ADAudit Plus web interface behind a reverse proxy or WAF configured with SQL injection rules.
• Enforce multi-factor authentication on all ADAudit Plus accounts to raise the bar for credential abuse.
• Review and minimize the database privileges granted to the ADAudit Plus service account to reduce blast radius.