CVE-2024-5487 is a high severity (CVSS 8.3) authenticated SQL injection in ManageEngine ADAudit Plus, in the Attack Surface Analyzer's export option for Cloud Directory. All builds below 8110 are affected. The vendor fixed it in build 8110 on 14 June 2024. Update through the service pack and confirm the build number afterward.
What's affected
ManageEngine's advisory lists every ADAudit Plus build below 8110 as affected, and build 8110 as the fixed version. The vendor gives the fix date as 14 June 2024. NVD agrees on the boundary: versions below 8110.
The weak spot is the export function of the Attack Surface Analyzer, specifically the Cloud Directory export. The vendor describes the impact in one sentence: an authenticated adversary could run custom queries and read database table entries through the vulnerable request.
Both the vendor and NVD call this high. NVD scores it 8.3 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. That vector means network reachable, low complexity, a logged-in account required, no user interaction, high confidentiality and integrity impact, and low availability impact.
The same build 8110 also fixes CVE-2024-5527, a separate injection in the file auditing configuration. If you are below 8110 you carry both.
How to check if you're exposed
This is a self-hosted Windows product, so there is no package manager to query. Open the ADAudit Plus web console and read the build number from the product's version information, then compare it with 8110. If the number is lower, you are exposed.
If you run more than one instance, such as a test copy and a production copy, check each one. Test instances are often left several builds behind.
Also list who can sign in. The flaw needs an authenticated user, so the size of your exposure depends on how many accounts can reach the console, and whether any of them are shared or stale. The advisory does not say which roles can reach the vulnerable function, so assume any valid login can until the vendor says otherwise.
For a wider view of what else in your estate runs old builds, the free in-browser dependency scan lets you check a manifest in your browser. It covers libraries your own software depends on, not installed products like this one, so keep a separate inventory for those.
What to do now
- Back up the ADAudit Plus installation and its database before touching anything.
- Download the service pack for build 8110 or later and apply it, following the steps in the vendor advisory.
- Open the console again and confirm the reported build is 8110 or higher.
- Review the accounts that can sign in to ADAudit Plus and remove any that are unused or shared.
- If you cannot update this week, limit network access to the console to the administrators who need it.
Why it matters
CWE-89, SQL injection, happens when user input ends up inside a database query without being kept apart from the query text. The database then treats part of the input as instructions. Here the injectable request is an export, a feature people tend to treat as read only and low risk. Export paths build queries from filter values just like any report page, so they need the same care.
ADAudit Plus sits in a sensitive place. It watches Active Directory, file servers and logons, so its database holds a record of who did what across the domain. An attacker who can read that data learns your account names, your lockout patterns and where your sensitive shares live. The record does not list this CVE in CISA's Known Exploited Vulnerabilities catalog, and neither the NVD record nor the vendor page reports exploitation. Treat it as a patching task, not an emergency.
Quick check
Do I need to be logged in to be hit by CVE-2024-5487?
Yes. The advisory and the CVSS vector both say authentication is required. The risk comes from any valid account being able to reach the database through the vulnerable feature.
Is CVE-2024-5487 fixed by the same update as other ADAudit Plus bugs?
Build 8110 fixes this one and CVE-2024-5527. Two other injection flaws, CVE-2024-5490 and CVE-2024-5556, were fixed earlier in build 8000, and CVE-2024-5586 needs build 8121. Updating to 8121 or later covers all five.
Sources
Last reviewed: 19 October 2026.
