Zohocorp ManageEngine Exchange Reporter Plus vulnerable to SQL Injection

CVE-2024-9459

What is CVE-2024-9459?

Zohocorp's ManageEngine Exchange Reporter Plus versions up to and including 5718 have a vulnerability in its reports module that allows authenticated attackers to execute SQL injection attacks. This flaw can potentially lead to unauthorized access to sensitive data stored in the database, manipulating query execution and compromising the application's integrity. It is crucial for users of affected versions to apply available security patches to mitigate the risks associated with this vulnerability.

References