CVE-2023-48792 is a SQL injection flaw in the report export option of Zoho ManageEngine ADAudit Plus. The record scores it 9.8 Critical, while the vendor rates the group of fixes High and says they need a login. Update to build 7271 or later and restrict who can reach the console.
What's affected
- Zoho ManageEngine ADAudit Plus. The NVD record says builds through 7250.
- The vendor security update says all ADAudit Plus builds below 7271 are affected, with the fix in build 7271, released on 12 January 2024. It is applied with the service pack.
- Source conflict on severity and access: the record scores 9.8 Critical with no privileges required, while the vendor labels the group High and describes the SQL injection issues as authenticated. Use the more cautious reading when you decide how fast to move.
- The vendor's notice covers several SQL injection issues, including summary report exports, dashboard views and file server configuration. CVE-2023-48793 is a sibling in the aggregate report feature.
- Severity: the record gives CVSS 9.8, which is critical. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.
The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Read plainly, it describes an attack over the network, with low attack complexity, requiring no privileges and no user interaction. Impact on confidentiality is high, on integrity high and on availability high. The scope is unchanged, so the impact stays within the vulnerable component.
How to check if you're exposed
Open the ADAudit Plus console and read the build number on the About page. Anything below 7271 is affected per the vendor.
Also check network exposure. ADAudit Plus watches Active Directory, so it holds sensitive data and powerful credentials. Confirm which networks and users can reach its web console, and whether it is reachable from the internet.
If you cannot read the build from the console, check your deployment records for the last service pack that was applied.
What to do now
- Apply the build 7271 service pack, or a later build, as the vendor describes.
- Restrict console access to administrator networks, and keep it off the public internet.
- Review which accounts can log in to ADAudit Plus and remove stale ones, since the vendor describes these issues as authenticated.
- Review database and application logs for unusual report export requests from before the upgrade.
- Treat the service account and database credentials as sensitive and rotate them if you find suspicious activity.
Why it matters
The class is CWE-89 (SQL Injection). The report export feature passes input into a database query in a way that lets that input change the query. The vendor's impact statement is that an authenticated adversary could run custom queries and read table entries.
Audit tools collect data about who did what in your directory, so the database behind them is valuable. A flaw in an export option is easy to overlook because reporting features are seen as read only. When the record and vendor differ on authentication, assume the worse case until you have patched.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which severity is right, 9.8 or High?
Both are published. The NVD record says 9.8 with no privileges, the vendor says High and authenticated. Patch on the faster timeline.
Are other CVEs fixed in the same build?
Yes. The vendor notice lists several, including CVE-2023-48793, in build 7271.
Sources
Last reviewed: 19 October 2026.
