CVE-2024-13162

What it actually does

CVE-2024-13162 is an authenticated SQL injection flaw in Ivanti Endpoint Manager (EPM) that affects versions before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update. A remote attacker who already has EPM administrative privileges can inject SQL into vulnerable server-side database operations. Because the affected application has privileged access to backend systems, successful exploitation can move beyond database manipulation and result in remote code execution on the EPM server or supporting infrastructure. The issue also represents an incomplete prior fix for CVE-2024-32848, so organizations that remediated only the earlier issue may still be exposed unless the January 2025 fixes are applied.

Why it matters to the business

Successful exploitation can allow an attacker with stolen or misused EPM administrator credentials to take control of the endpoint management platform. Because EPM is used to manage software, configuration, and endpoint operations across many systems, compromise can lead to broad operational disruption, unauthorized software deployment, credential theft, endpoint tampering, and potential enterprise-wide lateral movement. The EPSS score is high, indicating meaningful likelihood of exploitation activity, and the vulnerability has been public for an extended period, making overdue patching a priority even though it is not currently listed in CISA KEV and no public exploit maturity was provided.

How an attack unfolds

An attacker typically starts with valid Ivanti EPM administrative credentials, obtained through phishing, credential theft, password reuse, prior compromise, or abuse of an overprivileged account. After authenticating to the EPM interface or API, the attacker sends crafted input to a vulnerable database-backed function. The application passes that input into a SQL query without sufficient sanitization, allowing the attacker to alter query logic, execute additional SQL statements, or interact with dangerous database features. Depending on database permissions and application configuration, the attacker may read or modify EPM data, enable database command-execution capabilities, write files, or cause the database/application server to launch operating-system commands. From there, the attacker can establish persistence, deploy tools, steal credentials, alter endpoint management policies, or use the EPM server as a pivot point into managed endpoints.

How to fix it

Upgrade Ivanti EPM to a fixed release immediately. For EPM 2024, apply the January-2025 Security Update or any later cumulative/security update. For EPM 2022 SU6, apply the January-2025 Security Update or any later cumulative/security update. Because this vulnerability addresses an incomplete fix for CVE-2024-32848, do not assume systems patched only for the earlier CVE are protected. If immediate patching is not possible, restrict administrative access to Ivanti EPM to trusted management networks and VPNs, enforce MFA for all EPM administrators, review and reduce EPM administrative privileges, block direct internet exposure, monitor vulnerable functions closely, and ensure the database account used by EPM has only the minimum permissions required. Rotate credentials that may have been exposed if exploitation is suspected.

How to confirm the fix worked

Confirm the installed Ivanti EPM version and security update level from the product console, server inventory, installer metadata, or vendor-supported version checks, and verify it is at or above the January-2025 Security Update for the deployed branch. Validate that prior remediation did not stop at the incomplete CVE-2024-32848 fix. From a network perspective, verify that EPM administrative interfaces are not exposed to untrusted networks and that access controls require MFA and authorized administrative groups only. If using vulnerability scanners, ensure signatures explicitly check for CVE-2024-13162 or the January-2025 EPM security update level rather than only checking for older CVE-2024-32848 remediation. In a test environment only, authorized security teams may perform controlled SQL injection validation against the relevant EPM functionality to confirm that injected SQL syntax is rejected or safely parameterized.

Typical attack path

1. Obtain valid Ivanti EPM administrator credentials through credential theft, phishing, reuse, or prior compromise.
2. Authenticate remotely to the Ivanti EPM administrative interface or API.
3. Identify and access a vulnerable database-backed function affected by the incomplete SQL injection fix.
4. Submit crafted SQL input that changes intended database query behavior.
5. Escalate impact from database access to command execution where database permissions and server configuration allow it.
6. Run commands or drop tooling on the EPM server or related backend host.
7. Use EPM’s management role to enumerate managed endpoints, collect credentials, deploy payloads, or move laterally.
8. Clean up obvious artifacts such as temporary files, command history, or application requests while maintaining persistence.

How to detect it

Review activity from the publication date forward, with emphasis on authenticated EPM administrator sessions and any unusual administrative actions. Useful sources include Ivanti EPM application logs, web server or reverse-proxy logs, IIS logs if applicable, WAF logs, VPN/SSO/MFA logs for EPM administrator access, Windows Security logs on the EPM server, SQL Server audit/default trace/error logs, EDR process telemetry, PowerShell logs, and file creation events on the EPM and database servers. Look for requests made by administrative users containing SQL metacharacters, stacked queries, UNION-based probes, database error responses, time-delay functions, or attempts to invoke SQL Server extended stored procedures. Investigate any database or web/application service process spawning command shells, PowerShell, scripting engines, file transfer utilities, or certificate utilities. Also look for unusual EPM administrative behavior such as new admin accounts, unexpected package/software deployments, policy changes, endpoint task creation outside change windows, mass inventory queries, or access from unfamiliar IP addresses. Because no specific public exploit path is provided, prioritize behavioral detections over endpoint-specific signatures.

• UNION SELECT
• UNION ALL SELECT
• WAITFOR DELAY
• SLEEP(
• BENCHMARK(
• ' OR '1'='1
• " OR "1"="1
• ;--
• xp_cmdshell
• sp_configure 'xp_cmdshell'
• sp_oacreate
• sp_makewebtask
• OPENROWSET
• BULK INSERT
• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning certutil.exe
• sqlservr.exe spawning cmd.exe
• sqlservr.exe spawning powershell.exe
• sqlservr.exe spawning certutil.exe
• powershell -enc
• powershell -EncodedCommand
• certutil -urlcache
• bitsadmin /transfer
• rundll32.exe javascript:
• cmd.exe /c whoami
• cmd.exe /c ipconfig
• cmd.exe /c net user

What your security team should do

• Prioritize patching Ivanti EPM to the January-2025 Security Update or later because EPSS is high and the vulnerability has been public for a long period.
• Treat EPM administrators as high-value accounts: enforce MFA, review membership, remove stale admins, and investigate recent privilege changes.
• Search historical logs for suspicious authenticated administrator activity, SQL injection patterns, and command execution from EPM or database service contexts.
• Confirm EPM administrative interfaces are reachable only from trusted management networks and are not directly exposed to the internet.
• Review database permissions used by EPM and remove unnecessary high-risk capabilities such as operating-system command execution where not required.
• If suspicious activity is found, isolate the EPM server, preserve logs and disk artifacts, rotate EPM, database, and service account credentials, and review managed endpoints for unauthorized deployments.
• Add SIEM detections for SQL injection strings, SQL Server command-execution stored procedures, and unusual child processes spawned by web, application, or database services.