Description

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T08:16:42.987Z",
  "pubdate": "2026-08-13T08:16:42.987Z",
  "executiveSummary": "An authenticated SQL injection vulnerability has been identified in Zohocorp ManageEngine Password Manager Pro and ManageEngine PAM360. This security flaw allows malicious actors with authenticated access to execute arbitrary database queries by manipulating input parameters that are insufficiently sanitized before being processed by the underlying database management system. The vulnerability presents significant risk implications, potentially enabling unauthorized access to sensitive credential stores, database enumeration, data exfiltration, and compromise of the underlying application infrastructure. Successful exploitation requires prior authentication within the target system, though the specific privilege level required is tied to the affected application endpoints. Impacted products include Zohocorp ManageEngine Password Manager Pro versions prior to 13232 and ManageEngine PAM360 versions prior to 8552. Organizations utilizing these vulnerable software deployments face potential confidentiality, integrity, and availability risks if unauthorized users or compromised low-privileged accounts are leveraged to interact with vulnerable database query handlers.",
  "technicalDetails": "The vulnerability stems from improper neutralization of special elements used in SQL commands within the application logic of Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552. When an authenticated user submits input to vulnerable application endpoints, the parameters are concatenated or dynamically interpolated directly into SQL statements without adequate parameterization, input validation, or escaping.\nThe exploitation method relies on supplying crafted input containing SQL syntax, commands, or boolean/union-based payloads through HTTP requests destined for the application's backend database interaction handlers. Because the application fails to enforce strict type checking or utilize parameterized queries for the affected functions, the database engine interprets the malicious input as executable query logic rather than literal data values.\nThe attack flow typically proceeds as follows: First, the adversary authenticates to the target ManageEngine instance using valid credentials, which may originate from a standard low-privileged user account. Second, the attacker identifies application functions or endpoints that accept user-supplied parameters destined for database retrieval or manipulation tasks. Third, the attacker crafts an injection payload designed to manipulate the query structure, such as appending UNION SELECT statements to extract unauthorized data from adjacent database tables or altering conditional clauses to bypass logical checks. Fourth, the backend database processes the modified query, returning sensitive information, internal database metadata, or execution results back to the application, which subsequently exposes the data within the HTTP response or utilizes it to alter application behavior.\nThe root cause is rooted in insecure coding practices concerning database interaction layers within the vulnerable components of the software. The affected versions lack proper abstraction layers or parameterized query implementation across specific application modules. The post-exploitation impact includes full database read and write access, potential escalation of privileges within the application environment, and unauthorized extraction of stored administrative credentials, session tokens, or other sensitive vaults managed by Password Manager Pro and PAM360."
}