CVE-2025-8324 - Vulnerability Details - OpenCVE

Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Zohocorp	Manageengine Analytics Plus

No data.

No data.

References

Link	Providers
https://www.manageengine.com/analytics-plus/CVE-2025-8324.html

History

Wed, 07 Jan 2026 17:30:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:zohocorp:manageengine_analytics_plus::::::::

Wed, 07 Jan 2026 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 12 Nov 2025 13:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Zohocorp Zohocorp manageengine Analytics Plus
Vendors & Products		Zohocorp Zohocorp manageengine Analytics Plus

Tue, 11 Nov 2025 13:15:00 +0000

Type	Values Removed	Values Added
Description		Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.
Title		SQL Injection
Weaknesses		CWE-89
References		https://www.manageengine.com/analytics-plus/CVE-2025-8324.html
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Zohocorp

Published: 2025-11-11T13:04:00.573Z

Updated: 2026-01-07T17:09:49.147Z

Reserved: 2025-07-30T06:00:05.522Z

Link: CVE-2025-8324

Vulnrichment

Updated: 2026-01-07T17:05:15.115Z

NVD

Status : Awaiting Analysis

Published: 2025-11-11T13:15:45.443

Modified: 2025-11-12T16:19:34.210

Link: CVE-2025-8324

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8324", "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "state": "PUBLISHED", "assignerShortName": "Zohocorp", "dateReserved": "2025-07-30T06:00:05.522Z", "datePublished": "2025-11-11T13:04:00.573Z", "dateUpdated": "2026-01-07T17:09:49.147Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ManageEngine Analytics Plus", "vendor": "Zohocorp", "versions": [{"lessThan": "6171", "status": "affected", "version": "0", "versionType": "6171"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zohocorp:manageengine_analytics_plus:*:*:*:*:*:*:*:*", "versionEndExcluding": "6171", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Zohocorp ManageEngine Analytics Plus versions <span style=\"background-color: rgb(255, 255, 255);\">6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.</span><br>"}], "value": "Zohocorp ManageEngine Analytics Plus versions\u00a06170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "shortName": "Zohocorp", "dateUpdated": "2025-11-11T13:05:23.940Z"}, "references": [{"url": "https://www.manageengine.com/analytics-plus/CVE-2025-8324.html"}], "source": {"discovery": "UNKNOWN"}, "title": "SQL Injection", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8324", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-13T04:55:24.080236Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T17:09:49.147Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8324", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-13T04:55:24.080236Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T17:05:15.115Z"}}], "cna": {"title": "SQL Injection", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Zohocorp", "product": "ManageEngine Analytics Plus", "versions": [{"status": "affected", "version": "0", "lessThan": "6171", "versionType": "6171"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.manageengine.com/analytics-plus/CVE-2025-8324.html"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Zohocorp ManageEngine Analytics Plus versions\u00a06170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.", "supportingMedia": [{"type": "text/html", "value": "Zohocorp ManageEngine Analytics Plus versions <span style=\"background-color: rgb(255, 255, 255);\">6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zohocorp:manageengine_analytics_plus:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6171", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "shortName": "Zohocorp", "dateUpdated": "2025-11-11T13:05:23.940Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8324", "state": "PUBLISHED", "dateUpdated": "2026-01-07T17:09:49.147Z", "dateReserved": "2025-07-30T06:00:05.522Z", "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "datePublished": "2025-11-11T13:04:00.573Z", "assignerShortName": "Zohocorp"}, "dataVersion": "5.2"}