CVE-2025-8324: Unauthenticated SQL Injection Vulnerability in Analytics Plus on-premise

Severity: Critical

CVE ID: CVE-2025-8324

Details

An unauthenticated SQL injection vulnerability (CVE-2025-8324) has been identified in Analytics Plus on-premise. This vulnerability could allow attackers to execute arbitrary SQL queries due to insufficient input validation.

Impact

This vulnerability could lead to the unauthorized exposure of user information, potentially resulting in account takeovers.

Fix

The issue has been resolved by enforcing strict restrictions on vulnerable URLs and removing the insecure code.

Steps to upgrade

1. Kindly download the latest upgrade pack from the service pack page.
2. Follow the instructions detailed in the above service pack page to upgrade to the latest build.

For any questions or concerns, please write to us at:

• EU region: analyticsplus-support@manageengine.eu
• Other regions: analyticsplus-support@manageengine.com