Authenticated SQL Injection Vulnerability

This document explains the CVE-2022-47523 - Authenticated SQL Injection Vulnerability that has been reported.

CVE ID: CVE-2022-47523
Severity: High
Update Release build: 10.1.2228.19
Update Release Date: Jan 07, 2023
Reported by: nextheia.com via ManageEngine's Bug bounty program.

What was the problem?

An authenticated SQL injection vulnerability in Patch Manager Plus (CVE-2022-47523) was identified which may allow an adversary to execute custom queries and access the database table entries. This has now been fixed by enhancing validation and escaping special characters.

How to fix it?

Upgrading to the latest version is strongly advised due to this vulnerability's severity. To upgrade, follow the steps below:

  1. Login to the Patch Manager Plus console, and click on your current build number in the top right corner.
  2. You'll be able to find the latest build applicable to you. Download the PPM and update.

For any further questions or concerns on this, please write to our support team at patchmanagerplus-support@manageengine.com