Authenticated SQL Injection Vulnerabilities fixed in ADAudit Plus build 8003

Severity: High

CVE ID: CVE-2024-36034, CVE-2024-36035

Affected Software Version(s): All ADAudit Plus builds below 8003

Fixed Version: Build 8003

Fixed on: April 29, 2024

Details: Authenticated SQL injection vulnerabilities in ADAudit Plus' User Session Recording and the Search function in Aggregate Reports have been fixed.

Impact: These vulnerabilities can allow an authenticated adversary to execute custom queries and access the database table entries using the vulnerable request.

Steps to Upgrade: Update your ADAudit Plus instance to the latest build — 8003 — using the service pack.

Acknowledgments: These issues were reported by Minh Vo Van (aka minhgalaxy) at bl4ckh0l3 from GalaxyOne.

Please contact support@adauditplus.com for more details.