CVE-2026-5785

Executive Summary

CVE-2026-5785 is a critical authenticated SQL injection vulnerability discovered in Zohocorp ManageEngine PAM360 (versions before 8531) and ManageEngine Password Manager Pro (versions 8600 to 13230). The flaw resides in the query report module, allowing an authenticated attacker to inject arbitrary SQL commands. Successful exploitation could lead to unauthorized access to sensitive data, including privileged account credentials, session tokens, and internal database structures. The vulnerability has a CVSS score of 8.1 (High) and is currently unpatched in the wild, though vendor patches are available. No public proof-of-concept or exploit code has been released at this time.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs valid credentials.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Potential for denial of service via destructive queries.

Threat Level: High. The combination of low privileges required and high impact makes this a priority for patching.

Deep Dive & Mechanics

The vulnerability exists in the query report module, which allows authenticated users to create custom database queries for reporting purposes. The module fails to properly sanitize user-supplied input before constructing SQL statements. An attacker with a valid account can inject malicious SQL code into the report parameters, bypassing the intended query logic.

Attack Flow:

1. Attacker authenticates to the ManageEngine PAM360 or Password Manager Pro web interface.
2. Navigates to the query report module (e.g., /report/queryReport.do).
3. Injects SQL payloads into input fields such as reportName, query, or filter parameters.
4. The application concatenates the malicious input directly into a SQL statement.
5. The database executes the attacker-controlled query, returning sensitive data or performing unauthorized operations.

Impact:

• Extraction of all stored passwords, secrets, and privileged account credentials.
• Access to user session tokens and administrative accounts.
• Potential lateral movement within the network using compromised credentials.
• Data integrity loss if UPDATE or DELETE statements are injected.

Vulnerable vs. Patched Code

Vulnerable Code (Pseudo):

String userInput = request.getParameter("reportQuery");
String sql = "SELECT * FROM reports WHERE name = '" + userInput + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(sql);

Patched Code (Pseudo):

String userInput = request.getParameter("reportQuery");
String sql = "SELECT * FROM reports WHERE name = ?";
PreparedStatement pstmt = connection.prepareStatement(sql);
pstmt.setString(1, userInput);
ResultSet rs = pstmt.executeQuery();

The patched version uses parameterized queries (prepared statements) to separate SQL logic from user input, preventing injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: ManageEngine PAM360 v8530 or Password Manager Pro v13230
• Attacker: Kali Linux with SQLMap and Burp Suite

Exploitation Steps:

1. Authenticate to the web interface with valid credentials.
2. Intercept the request to the query report module using Burp Suite.
3. Identify injectable parameters (e.g., reportName, query).
4. Use SQLMap to automate injection:

   sqlmap -u "https://target/report/queryReport.do?reportName=test" --cookie="JSESSIONID=..." --batch --dump
   

5. Alternatively, manually inject:

   ' OR '1'='1' -- 
   

6. Extract database contents:

   ' UNION SELECT username, password FROM users -- 
   

Note: No public exploit code is available; the above is a generic SQL injection technique.

Blue Team (Defensive)

Detection & Response:

• Monitor for unusual SQL queries in database logs (e.g., UNION, OR 1=1).
• Enable Web Application Firewall (WAF) rules to block SQL injection patterns.
• Restrict database user permissions to least privilege.
• Implement input validation and parameterized queries in custom reports.

Hunting Queries:

• Search for requests to /report/queryReport.do with suspicious parameters.
• Alert on database errors returned to the user (e.g., SQL syntax).

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /report/queryReport.do with reportName or query parameters containing SQL keywords (UNION, SELECT, OR).
  • Database error messages in HTTP responses (e.g., You have an error in your SQL syntax).
• Host:
  • Unusual database queries in logs (e.g., SELECT * FROM information_schema.tables).
  • New user accounts or modified privileges in the ManageEngine database.
• File:
  • Temporary files created by SQLMap in /tmp/ or %TEMP%.

Detection Engineering

YARA Rule

rule CVE_2026_5785_SQLi_Request {
    meta:
        description = "Detects SQL injection attempts targeting ManageEngine PAM360/Password Manager Pro query report module"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-5785"
    strings:
        $s1 = "/report/queryReport.do" nocase
        $s2 = "reportName=" nocase
        $s3 = "query=" nocase
        $sql1 = "UNION" nocase
        $sql2 = "OR 1=1" nocase
        $sql3 = "SELECT" nocase
        $sql4 = "DROP" nocase
    condition:
        $s1 and ($s2 or $s3) and any of ($sql*)
}

Sigma Rule

title: CVE-2026-5785 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against ManageEngine PAM360/Password Manager Pro query report module
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "/report/queryReport.do"
        cs-uri-query|contains|all:
            - "reportName="
            - "UNION"
            - "SELECT"
    condition: selection
falsepositives:
    - Legitimate use of UNION in report names (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-5785 SQL Injection Attempt - ManageEngine PAM360/Password Manager Pro";
    flow:to_server,established;
    content:"/report/queryReport.do"; http_uri;
    content:"reportName="; http_uri;
    pcre:"/(UNION|SELECT|OR\s+1=1|DROP)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade PAM360 to version 8531 or later.
2. Upgrade Password Manager Pro to version 13231 or later.
3. If patching is not possible, disable the query report module temporarily.
4. Review and restrict user permissions to only necessary roles.

Long-term Measures:

• Implement input validation and parameterized queries in all custom report modules.
• Conduct regular security audits and penetration testing.
• Deploy a Web Application Firewall (WAF) with SQL injection prevention rules.
• Monitor database logs for anomalous queries.

Workaround:

• Remove the queryReport.do servlet mapping in the web.xml configuration file until a patch is applied.

Valters IT

{/* [Security Hash: ADD6367F88C9CDBC43F8EB56] */}