CVE-2025-41444: ManageEngine ADAudit Plus SQLi Flaw

CVE-2025-41444 Overview

CVE-2025-41444 is an authenticated SQL injection vulnerability affecting Zohocorp ManageEngine ADAudit Plus versions 8510 and prior. The flaw resides in the alerts module, where user-supplied input reaches database queries without proper sanitization. An authenticated attacker can manipulate SQL statements to access or modify backend data. The weakness is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). ManageEngine published an advisory and fixed build addressing the issue.

Critical Impact

Authenticated attackers with low privileges can inject arbitrary SQL through the alerts module, leading to confidentiality and integrity loss within the ADAudit Plus database backing Active Directory audit data.

Affected Products

• Zohocorp ManageEngine ADAudit Plus version 8.5 (build 8500)
• Zohocorp ManageEngine ADAudit Plus version 8.5 (build 8510)
• All Zohocorp ManageEngine ADAudit Plus releases prior to build 8511

Discovery Timeline

• 2025-06-09 - CVE-2025-41444 published to NVD
• 2025-06-16 - Last updated in NVD database

Technical Details for CVE-2025-41444

Vulnerability Analysis

The vulnerability is an authenticated SQL injection in the alerts module of ManageEngine ADAudit Plus. ADAudit Plus is a real-time Active Directory (AD) change auditing and reporting product widely deployed in enterprise environments. The alerts module allows administrators to configure conditions and parameters that govern when notifications fire. One or more of these parameters flows into a SQL statement without parameterized binding or input neutralization, enabling an attacker to alter query semantics.

Because exploitation requires valid credentials, the attack surface is constrained to users who can authenticate to the product. The CVSS vector indicates network reachability, low attack complexity, and low privileges required, with high impact to confidentiality and integrity and low impact to availability.

Root Cause

The root cause is improper neutralization of special characters in SQL statements within the alerts module ([CWE-89]). User-controlled input is concatenated into dynamic SQL rather than being passed through prepared statements or strict allow-list validation, allowing operators such as UNION, OR, comment sequences, and stacked queries to alter the query.

Attack Vector

An authenticated attacker sends crafted HTTP requests to the alerts module endpoints over the network. The injected payload modifies the constructed SQL, allowing extraction of audit records, configuration data, or stored credentials, and in some cases enabling write operations against database rows. Because ADAudit Plus aggregates sensitive Active Directory telemetry, successful exploitation exposes records about user accounts, group changes, logon events, and policy modifications.

No public proof-of-concept code is available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 3.936% at the 88.457 percentile, indicating elevated relative exploitation likelihood among scored CVEs. Refer to the ManageEngine CVE-2025-41444 Advisory for vendor technical guidance.

Detection Methods for CVE-2025-41444

Indicators of Compromise

• Unexpected HTTP requests to ADAudit Plus alerts module endpoints containing SQL metacharacters such as ', --, ;, UNION SELECT, or OR 1=1.
• Database error messages or stack traces in ADAudit Plus server logs referencing malformed SQL originating from alert configuration handlers.
• Authenticated sessions issuing high volumes of alert-related requests with varying payload lengths, consistent with automated SQLi tooling.
• New or modified alert profiles tied to accounts that do not normally administer alerting.

Detection Strategies

• Inspect ADAudit Plus application and access logs for parameters containing SQL syntax submitted to the alerts module.
• Deploy web application firewall (WAF) signatures for SQL injection patterns scoped to the ADAudit Plus management URL paths.
• Correlate authentication events with subsequent alert module activity to identify low-privilege accounts probing the interface.
• Monitor the underlying database for unusual query shapes, schema enumeration against INFORMATION_SCHEMA, or unexpected UNION-based reads.

Monitoring Recommendations

• Forward ADAudit Plus web server logs, application logs, and database audit logs to a centralized analytics platform for query-pattern analysis.
• Establish a baseline of legitimate alert configuration activity per administrator and alert on deviations.
• Track failed and successful login events for ADAudit Plus, particularly from accounts that subsequently access the alerts module.

How to Mitigate CVE-2025-41444

Immediate Actions Required

• Upgrade ADAudit Plus to the fixed build released by Zohocorp as referenced in the ManageEngine CVE-2025-41444 Advisory.
• Audit ADAudit Plus user accounts and remove unnecessary privileges, enforcing least privilege for any account that can authenticate to the console.
• Rotate credentials for service and administrator accounts used by ADAudit Plus following the upgrade.
• Review alert module configurations and audit logs for unauthorized changes prior to patching.

Patch Information

Zohocorp has released a fixed build of ManageEngine ADAudit Plus that remediates the SQL injection in the alerts module. Administrators running build 8510 or earlier must apply the update referenced in the vendor advisory. The advisory at ManageEngine CVE-2025-41444 Advisory lists the patched build number and upgrade procedure.

Workarounds

• Restrict network access to the ADAudit Plus web console to trusted management subnets using firewall rules or reverse proxy access control.
• Enforce multi-factor authentication on all ADAudit Plus accounts to reduce the risk of credential abuse enabling exploitation.
• Place a web application firewall in front of ADAudit Plus with SQL injection rule sets enabled until the patch is applied.
• Disable or limit access to the alerts module for non-administrative accounts where operationally feasible.

# Configuration example: restrict ADAudit Plus console access via host firewall (Windows)
netsh advfirewall firewall add rule name="ADAuditPlus-Console-Allow" ^
  dir=in action=allow protocol=TCP localport=8081 ^
  remoteip=10.0.0.0/24
netsh advfirewall firewall add rule name="ADAuditPlus-Console-Deny" ^
  dir=in action=block protocol=TCP localport=8081