CVE-2024-5546
8.3 HIGH
📋 TL;DR
This vulnerability allows authenticated attackers to execute arbitrary SQL commands via the global search feature in ManageEngine Password Manager Pro and PAM360. Attackers could potentially access, modify, or delete sensitive password management data. Organizations using affected versions of these products are at risk.
💻 Affected Systems
Products:
- ManageEngine Password Manager Pro
- ManageEngine PAM360
Versions: Password Manager Pro versions before 12431, PAM360 versions before 7001
Operating Systems: All supported platforms
Default Config Vulnerable:
⚠️ Yes
Notes: Requires authenticated access to the web interface. The global search feature is typically available to users with appropriate permissions.
📦 What is this software?
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
Manageengine Password Manager Pro by Zohocorp
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the password management database, allowing attackers to exfiltrate all stored credentials, modify access controls, or delete critical authentication data.
Likely Case
Unauthorized access to sensitive password data, credential theft, and potential lateral movement within the network using stolen credentials.
If Mitigated
Limited data exposure if proper network segmentation and access controls prevent attackers from reaching the vulnerable interface.
🌐 Internet-Facing: HIGH
🏢 Internal Only: HIGH
🎯 Exploit Status
Public PoC:
✅ No
Weaponized:
UNKNOWN
Unauthenticated Exploit:
✅ No
Complexity:
LOW
Exploitation requires valid user credentials. SQL injection via search functionality is typically straightforward for attackers with basic SQL knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Password Manager Pro 12431 or later, PAM360 7001 or later
Vendor Advisory: https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2024-5546.html
Restart Required: Yes
Instructions:
1. Download the latest version from the ManageEngine website
2. Backup your current installation and database
3. Stop the ManageEngine service
4. Install the update following vendor instructions
5. Restart the service and verify functionality
🔧 Temporary Workarounds
Disable Global Search
allTemporarily disable the global search feature to prevent exploitation while patching
Restrict Access
allLimit network access to the ManageEngine web interface to only trusted IP addresses
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the ManageEngine server from untrusted networks
- Enforce strong authentication policies and monitor for suspicious user activity
🔍 How to Verify
Check if Vulnerable:
Check the product version in the web interface under Help > About. For Password Manager Pro, verify version is below 12431. For PAM360, verify version is below 7001.Check Version:
Check via web interface: Help > About, or check installation directory for version filesVerify Fix Applied:
After updating, confirm the version shows 12431 or higher for Password Manager Pro, or 7001 or higher for PAM360.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed search attempts with special characters
- User accounts performing unexpected global searches
Network Indicators:
- Unusual database connections from the application server
- Large data transfers following search requests
SIEM Query:
source="manageengine*" AND ("global search" OR "search") AND (sql OR "'" OR "--" OR ";")