SQL injection in ManageEngine Access Manager Plus - CVE-2022-47523
Published: January 1, 2023 / Updated: January 17, 2023
Vulnerability identifier: #VU70548
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-47523
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
Affected software
ManageEngine Access Manager Plus
Zoho ManageEngine Desktop Central
PAM 360
Password Manager Pro
Zoho ManageEngine Desktop Central
PAM 360
Password Manager Pro
How to mitigate CVE-2022-47523
Install updates from vendor's website.
ManageEngine Access Manager Plus - update to 4.3 4309
Zoho ManageEngine Desktop Central - update to 10.1.2228.19
PAM 360 - update to 5801
Password Manager Pro - update to 12210
Zoho ManageEngine Desktop Central - update to 10.1.2228.19
PAM 360 - update to 5801
Password Manager Pro - update to 12210