Cyber Posture

CVE-2025-8324

Critical

Published: 11 November 2025

Published
11 November 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0309 86.9th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Description

Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates unauthenticated SQL injection by requiring validation of all information inputs to block malicious SQL code execution.

prevent

Requires timely identification, reporting, and correction of flaws like this specific SQL injection vulnerability through patching.

prevent

Ensures establishment and enforcement of secure configuration settings, including proper filter configurations to address the improper filter causing the SQL injection.

Security SummaryAI

Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to CVE-2025-8324, an unauthenticated SQL injection flaw (CWE-89) caused by improper filter configuration. Published on 2025-11-11, this issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.

Remote attackers need no privileges or user interaction to exploit the vulnerability over the network with low attack complexity. Successful exploitation enables arbitrary SQL injection, resulting in high confidentiality, integrity, and availability impacts, such as data exfiltration, database manipulation, or service disruption.

Mitigation guidance is available in the vendor advisory at https://www.manageengine.com/analytics-plus/CVE-2025-8324.html.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

Unauthenticated SQL injection in a public-facing web application directly enables T1190 (Exploit Public-Facing Application). Exploitation facilitates arbitrary SQL queries for data exfiltration from databases (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References