CVE-2022-40300

What it actually does

CVE-2022-40300 is a set of unauthenticated, network-exploitable SQL injection vulnerabilities in Zoho ManageEngine Password Manager Pro, PAM360, and Access Manager Plus. Because affected versions improperly handle attacker-controlled input in database-backed application requests, an attacker can manipulate SQL queries executed by the application. With a CVSS 9.8 vector of AV:N/AC:L/PR:N/UI:N, exploitation requires no authentication, no user interaction, and can result in full compromise of confidentiality, integrity, and availability of application data. In password-vault and privileged-access-management products, successful SQL injection may expose highly sensitive secrets, stored credentials, privileged account metadata, session data, audit records, and configuration information, and may also allow data modification or destructive database operations depending on database permissions and application context.

Why it matters to the business

These products commonly store or broker access to privileged credentials, so compromise can have consequences far beyond the application itself. An attacker who exploits this flaw may be able to steal passwords, keys, connection details, and administrative records that enable lateral movement into servers, databases, network devices, cloud systems, and business applications. Operationally, this can lead to privileged-account compromise, loss of audit integrity, service disruption, forced credential rotation at scale, incident-response costs, and regulatory exposure. Although this CVE is not currently listed in CISA KEV and is not marked as ransomware-used, its EPSS score is extremely high, indicating a high likelihood of exploitation activity; exposed internet-facing instances should be treated as urgent remediation targets.

How an attack unfolds

An attacker first identifies an exposed ManageEngine Password Manager Pro, PAM360, or Access Manager Plus instance and determines whether it is running an affected version: Password Manager Pro through 12120, PAM360 through 5550, or Access Manager Plus through 4304. The attacker then sends crafted HTTP requests containing SQL control characters or expressions to vulnerable application parameters. If the application concatenates that input into SQL statements without proper parameterization, the database interprets attacker-supplied SQL as part of the query. The attacker can use error-based, boolean-based, time-based, or UNION-style techniques to confirm injection, enumerate database structure, extract sensitive records, modify application data, or attempt to disrupt the backing database. Because these products manage privileged secrets, exploitation can become a credential-harvesting event that enables follow-on compromise of unrelated infrastructure.

How to fix it

Upgrade affected products to fixed or later versions: ManageEngine Password Manager Pro 12121 or later, ManageEngine PAM360 5600 or later, and ManageEngine Access Manager Plus 4305 or later. If immediate upgrade is not possible, restrict access to the application to trusted administrative networks or VPNs, block direct internet exposure, enforce strong WAF rules for SQL injection payloads, monitor for suspicious request patterns, and ensure the backing database account uses least privilege. Because these systems store privileged secrets, remediation should also include post-upgrade credential-risk review: rotate highly privileged credentials managed by affected instances if exploitation cannot be confidently ruled out, review integration tokens and service accounts, and validate audit-log integrity. Maintain current backups before upgrade, but do not rely on backup restoration alone as a mitigation because stolen credentials may remain valid after the application is restored.

How to confirm the fix worked

Confirm the deployed product version is no longer in the affected range: Password Manager Pro must be 12121 or later, PAM360 must be 5600 or later, and Access Manager Plus must be 4305 or later. Validate through the product UI, build/version files, vendor update manager, package inventory, or authenticated vulnerability scanner results. Re-run vulnerability scans after patching and verify the application is not reachable from untrusted networks unless explicitly required. Review WAF, reverse proxy, application, and database logs around the exposure window for SQL injection probes or successful exploitation indicators. If practical in a controlled test environment, use a safe, non-destructive SQL injection validation payload to confirm that previously vulnerable parameters no longer alter responses or produce database errors.

Typical attack path

1. Discover internet-facing Zoho ManageEngine Password Manager Pro, PAM360, or Access Manager Plus instances through scanning, search engines, or asset-enumeration data.
2. Fingerprint the product and version using login pages, static assets, HTTP responses, exposed build information, or authenticated inventory where available.
3. Send crafted HTTP requests containing SQL metacharacters, boolean conditions, UNION clauses, stacked-query attempts, or time-delay payloads to vulnerable request parameters.
4. Observe application errors, response differences, timing delays, or anomalous HTTP status codes to confirm SQL injection behavior.
5. Enumerate database schema and application tables accessible to the application database account.
6. Extract sensitive data such as stored credentials, password records, user data, session artifacts, audit details, configuration data, and integration secrets.
7. Use stolen privileged credentials or secrets to access downstream systems, move laterally, establish persistence, or tamper with records.
8. Optionally modify or delete data to hide activity, disrupt operations, or degrade confidence in vault and privileged-access-management audit trails.

How to detect it

To determine whether exploitation already occurred, examine HTTP access logs, reverse proxy logs, WAF events, application logs, and database audit logs for suspicious requests and database behavior. Focus on the period from initial exposure of affected versions through the confirmed upgrade date. Look for requests containing SQL metacharacters, encoded SQL syntax, boolean tests, UNION SELECT attempts, time-delay functions, stacked-query delimiters, database error messages, and repeated probes against the same endpoint with small payload variations. Review application logs for SQL exceptions, stack traces, authentication anomalies, unexpected exports, new or modified administrative users, changes to password records, and tampering with audit settings. Review database logs for unusual SELECT volume, access to credential-related tables, failed syntax errors, time-delay functions, UNION queries, information_schema enumeration, unexpected UPDATE/DELETE statements, or queries executed outside normal application patterns. Correlate any suspicious application activity with downstream authentication logs because successful exploitation may lead to use of stolen credentials against other systems. No public threat actor attribution or KEV ransomware association is provided for this CVE, so detection should emphasize exploit technique and post-exploitation credential misuse rather than actor-specific infrastructure.

• UNION SELECT
• UNION%20SELECT
• UNION+SELECT
• information_schema
• information_schema.tables
• information_schema.columns
• SLEEP(
• BENCHMARK(
• WAITFOR DELAY
• pg_sleep(
• DBMS_PIPE.RECEIVE_MESSAGE
• OR 1=1
• OR%201=1
• AND 1=1
• AND%201=1
• '--
• %27--
• "--
• %22--
• ;--
• %3B--
• xp_cmdshell
• LOAD_FILE(
• INTO OUTFILE
• SQLSyntaxErrorException
• java.sql.SQLException
• org.postgresql.util.PSQLException
• com.mysql.jdbc.exceptions
• com.microsoft.sqlserver.jdbc.SQLServerException
• ORA-00933
• ORA-01756
• You have an error in your SQL syntax
• ManageEngine/PasswordManager_Pro/logs
• ManageEngine/PAM360/logs
• ManageEngine/AMP/logs
• access_log
• serverout
• wrapper.log

What your security team should do

• Prioritize patching immediately for any internet-facing or broadly reachable instance because the CVSS score is critical and EPSS is extremely high.
• Upgrade to Password Manager Pro 12121 or later, PAM360 5600 or later, and Access Manager Plus 4305 or later; verify the version after maintenance.
• Temporarily restrict access to trusted networks, VPN, or administrative jump hosts until patching and validation are complete.
• Search historical web, proxy, WAF, application, and database logs for SQL injection probes and abnormal database errors during the full period the instance was exposed.
• If compromise cannot be ruled out, rotate privileged credentials, service-account passwords, SSH keys, API tokens, and integration secrets stored or managed by the affected product.
• Review application users, administrative accounts, authentication settings, SSO integrations, scheduled tasks, and audit logs for unauthorized changes.
• Check for unusual outbound connections, unexpected database activity, large data exports, anomalous login behavior, and access to downstream systems using credentials stored in the product.
• Ensure the database account used by the application has only required privileges and cannot perform unnecessary administrative, file-write, or operating-system-level actions.
• Add or tune WAF/SIEM detections for SQL injection payloads targeting ManageEngine application paths and parameters.
• Preserve relevant logs and backups before performing major remediation if incident response or legal review may be required.