CVE-2022-47523

What it actually does

CVE-2022-47523 is an unauthenticated, network-exploitable SQL injection vulnerability affecting Zoho ManageEngine Access Manager Plus versions before 4309, Password Manager Pro versions before 12210, and PAM360 versions before 5801. A vulnerable request path fails to safely handle attacker-controlled input before constructing SQL queries, allowing crafted input to alter backend database queries. Because these products store and broker privileged credentials, successful exploitation can expose sensitive vault contents, modify application data, create or alter users, disrupt service availability, and potentially support follow-on compromise of managed systems depending on what secrets or sessions the attacker can retrieve.

Why it matters to the business

This is a critical-risk issue in privileged access and password management software. If exploited, an attacker may gain access to stored administrative credentials, privileged account metadata, session information, or configuration data, creating a direct path to broader enterprise compromise. Operationally, this can result in loss of control over privileged access workflows, credential theft, outage of password-management services, regulatory exposure, and emergency credential rotation across dependent systems. Although it is not currently listed in CISA KEV and no ransomware use is indicated, the EPSS score is high, meaning exploitation is statistically more likely than most vulnerabilities and should be prioritized.

How an attack unfolds

An attacker identifies an internet-facing or internally reachable ManageEngine Access Manager Plus, Password Manager Pro, or PAM360 instance running a vulnerable version. They send a crafted HTTP request containing SQL metacharacters or query fragments in a parameter processed by the affected application. Because input is not properly parameterized or sanitized, the backend database interprets part of the attacker-supplied value as SQL. The attacker can then iteratively confirm injection behavior using timing, error-based, boolean, or data-extraction techniques. With successful exploitation, they may enumerate database schema, extract credential vault data or user records, alter application records, create persistence through application-level accounts or configuration changes, and use any recovered secrets for lateral movement into downstream infrastructure.

How to fix it

Upgrade affected products to fixed versions immediately: ManageEngine Access Manager Plus 4309 or later, ManageEngine Password Manager Pro 12210 or later, and ManageEngine PAM360 5801 or later. If immediate patching is not possible, restrict access to the application interface using VPN, private network access, firewall allowlists, and administrative segmentation; block direct internet exposure; and monitor for SQL injection payloads. Review vendor advisories and release notes for any additional post-upgrade steps. After patching, rotate high-value credentials stored in or managed by the affected product if exploitation cannot be confidently ruled out, especially privileged, domain, cloud, database, network device, and break-glass credentials.

How to confirm the fix worked

Confirm the deployed product and build version from the administrative console or installation metadata and verify it is at or above the fixed release: Access Manager Plus 4309, Password Manager Pro 12210, or PAM360 5801. Validate that all externally and internally reachable instances have been upgraded, including disaster recovery, standby, lab, and legacy deployments. Use authenticated vulnerability scanning or configuration management inventory to confirm no vulnerable builds remain. Where safe and authorized, perform non-destructive testing with benign SQL metacharacters or scanner checks to verify that previously vulnerable inputs no longer produce SQL errors, timing differences, or abnormal responses. Confirm compensating controls by testing that only approved networks can reach the web interface.

Typical attack path

1. Scan for exposed Zoho ManageEngine Access Manager Plus, Password Manager Pro, or PAM360 web interfaces.
2. Determine whether the product version is earlier than Access Manager Plus 4309, Password Manager Pro 12210, or PAM360 5801.
3. Send crafted HTTP requests containing SQL injection payloads to the vulnerable endpoint or parameter.
4. Confirm injection using SQL errors, boolean response differences, or time-delay behavior.
5. Enumerate database metadata, application users, vault records, configuration data, or credential references.
6. Extract sensitive data or modify records where database permissions allow.
7. Use recovered credentials or application access to compromise managed systems or maintain persistence.
8. Cover tracks by deleting or altering application, web, or database logs where access permits.

How to detect it

To determine whether exploitation has already occurred, review HTTP access logs from the ManageEngine application, reverse proxies, load balancers, and WAFs for requests containing SQL injection metacharacters, UNION-based queries, time-delay functions, comment delimiters, or encoded equivalents. Correlate suspicious requests with application logs and database logs for SQL syntax errors, abnormal query failures, long-running queries, or unexpected access to credential-related tables and administrative functions. Examine product audit logs for new or modified users, privilege changes, password exports, password retrievals, API key creation, integration changes, and configuration updates occurring near suspicious web requests. Review database logs for errors or anomalous queries associated with the application account. Investigate subsequent use of credentials managed by the affected product, including unusual logins to servers, databases, network devices, cloud consoles, and privileged accounts from new IP addresses or at unusual times. Because public exploit maturity is not indicated but EPSS is high, treat scanning and probing as likely and investigate any successful-looking injection behavior or unexplained administrative changes.

• UNION SELECT
• UNION/**/SELECT
• information_schema
• pg_sleep(
• SLEEP(
• WAITFOR DELAY
• benchmark(
• ' OR '1'='1
• " OR "1"="1
• OR 1=1
• --
• /*
• */
• %27%20OR%20%271%27%3D%271
• %22%20OR%20%221%22%3D%221
• %55%4e%49%4f%4e%20%53%45%4c%45%43%54
• SQLException
• SQLSyntaxErrorException
• PSQLException
• org.postgresql.util.PSQLException
• syntax error at or near
• unterminated quoted string
• ERROR: syntax error
• ManageEngine/PasswordManagerPro/logs
• ManageEngine/PAM360/logs
• ManageEngine/AccessManagerPlus/logs

What your security team should do

• Prioritize upgrade of all affected ManageEngine PAM, password vault, and access-management instances because compromise could expose privileged credentials.
• Identify every deployment of Access Manager Plus, Password Manager Pro, and PAM360, including internal-only and backup instances.
• Remove direct internet exposure wherever possible and enforce network allowlisting for administrative access.
• Review application, web, reverse proxy, WAF, and database logs for SQL injection attempts and suspicious post-exploitation activity.
• If suspicious activity is found or logs are incomplete, assume stored privileged credentials may be exposed and initiate risk-based credential rotation.
• Audit application users, administrator accounts, API keys, scheduled tasks, integrations, and configuration changes for unauthorized modifications.
• Increase monitoring for use of credentials stored in the affected products, especially abnormal logins, new source IPs, and lateral movement.
• Create SIEM detections for SQL injection patterns against ManageEngine web paths and for database errors returned by the application.
• Preserve logs and forensic artifacts before upgrading or rebuilding systems if exploitation is suspected.