CVE-2022-29535

What it actually does

This vulnerability is an unauthenticated, network-exploitable SQL injection flaw in Zoho ManageEngine OpManager versions through 125588, reachable through certain default reporting functionality. Because attacker-controlled input can be incorporated into backend SQL queries without proper sanitization, an attacker can manipulate database queries to read sensitive data, modify records, bypass application logic, or potentially achieve deeper compromise depending on database privileges, application configuration, and database features. The CVSS 9.8 rating reflects low exploitation complexity, no authentication requirement, and potential high impact to confidentiality, integrity, and availability.

Why it matters to the business

Successful exploitation can expose monitoring data, credentials or integration secrets stored by the platform, device inventory, network topology, alerting information, and administrative configuration. Since OpManager is commonly used to monitor critical infrastructure, compromise can also reduce operational visibility, enable tampering with monitoring results, or support follow-on attacks against managed systems. Although this CVE is not currently listed in CISA KEV and no ransomware association is indicated, the EPSS score is very high, so internet-exposed or widely reachable deployments should be treated as high-priority remediation candidates.

How an attack unfolds

An attacker first identifies an accessible Zoho ManageEngine OpManager instance running an affected version through 125588. They then interact with vulnerable default report functionality and submit crafted parameters containing SQL control syntax. If the application passes that input into a database query unsafely, the attacker can alter the query logic to enumerate database structure, extract sensitive records, or perform write operations. In more advanced cases, the attacker may attempt stacked queries, database-specific functions, or error/time-based techniques to expand access, harvest credentials, disable or alter monitoring records, and use the compromised monitoring platform as a pivot point for reconnaissance or lateral movement.

How to fix it

Upgrade Zoho ManageEngine OpManager to a vendor-supported release newer than 125588 that includes the SQL injection fix. If an immediate upgrade is not possible, restrict access to the OpManager web interface to trusted administrative networks or VPNs, block internet exposure, enforce strong authentication and least privilege, and place compensating controls such as a WAF or reverse proxy rule to block SQL injection payloads against report-related endpoints. Review database permissions used by the application and ensure the application account does not have unnecessary administrative privileges. After patching, rotate credentials and integration secrets stored in or accessible to OpManager if there is any evidence of exploitation.

How to confirm the fix worked

Confirm the installed OpManager build is greater than 125588 or otherwise matches the vendor-fixed release documented for this issue. Verify that the OpManager web interface and report features are not reachable from untrusted networks. Use authenticated administrative checks, vulnerability scanners, or vendor guidance to confirm the vulnerable report paths no longer accept SQL control syntax. Review reverse proxy, WAF, web access, application, and database logs for attempted SQL injection strings before and after remediation. Where safe and authorized, perform a controlled validation test using benign SQL injection probes to confirm that report parameters are properly rejected, escaped, or parameterized.

Typical attack path

1. Discover an exposed or internally reachable Zoho ManageEngine OpManager web interface.
2. Fingerprint the product and version to determine whether it is at or below 125588.
3. Access vulnerable default report functionality without authentication, if exposed.
4. Send crafted report parameters containing SQL injection payloads such as boolean, UNION-based, error-based, or time-based SQL syntax.
5. Enumerate database type, table names, and application data if injection succeeds.
6. Extract sensitive monitoring, credential, integration, inventory, or configuration data.
7. Optionally modify database records, create persistence through application-level changes, suppress alerts, or stage follow-on access depending on privileges.

How to detect it

To determine whether exploitation has already occurred, review OpManager web access logs, reverse proxy logs, WAF events, application logs, and database audit/error logs covering the period before remediation. Focus on requests to report-related functionality that contain SQL metacharacters, encoded SQL keywords, repeated parameter tampering, unusual HTTP 500 responses, database syntax errors, or delayed responses consistent with time-based SQL injection. Look for database errors referencing malformed SELECT, UNION, ORDER BY, or quoted strings. Investigate unusual access to default reports from unfamiliar IP addresses, high-volume report requests, unexpected export activity, changes to OpManager administrative users, altered monitoring configuration, disabled alerts, or unexplained database modifications. If exploitation is suspected, correlate source IPs across perimeter logs, WAF alerts, OpManager logs, and database logs, then examine whether sensitive tables, credential stores, or integration settings were queried or changed.

• UNION SELECT
• UNION%20SELECT
• UNION+SELECT
• information_schema
• INFORMATION_SCHEMA
• SLEEP(
• sleep(
• BENCHMARK(
• benchmark(
• pg_sleep(
• WAITFOR DELAY
• ORDER BY
• or 1=1
• OR 1=1
• ' OR '1'='1
• " OR "1"="1
• --
• /*
• */
• %27%20OR%20%271%27%3D%271
• %22%20OR%20%221%22%3D%221
• SQL syntax
• syntax error at or near
• You have an error in your SQL syntax
• java.sql.SQLException
• com.mysql.jdbc.exceptions
• org.postgresql.util.PSQLException
• ManageEngine/OpManager/logs
• OpManager/logs

What your security team should do

• Treat affected OpManager deployments as high priority because the flaw is unauthenticated, network exploitable, high impact, and has a very high EPSS score.
• Inventory all Zoho ManageEngine OpManager instances and identify any running versions through 125588.
• Patch or upgrade affected systems to a fixed vendor-supported version as soon as possible.
• Immediately remove direct internet exposure and limit access to trusted administrative networks if patching cannot be completed quickly.
• Search historical web, WAF, reverse proxy, application, and database logs for SQL injection attempts against OpManager report functionality.
• If suspicious activity is found, preserve logs, snapshot the system, review database contents and administrative users, and rotate credentials stored in or used by OpManager.
• Harden the deployment by enforcing least-privilege database access, restricting administrative interfaces, and monitoring for anomalous report access or database errors.