Zoho, a business software provider, released a security advisory encouraging its customers to immediately patch a critical security flaw affecting three ManageEngine products, BleepingComputer reports.
The SQL injection vulnerability, CVE-2022-47523, was found in Zoho's PAM360 privileged access management software, Password Manager Pro secure vault, and Access Manager Plus privileged session management solution.
The bug would grant attackers unauthenticated access to the backend database and let them execute custom queries to gain access to database table entries, the firm warned.
"[G]iven the severity of this vulnerability, customers are strongly advised to upgrade to the latest build of PAM360, Password Manager Pro and Access Manager Plus immediately."
Zoho said the issue was fixed last month by adding proper validation and escaping special characters. For installation upgrade, customers must first download the latest upgrade pack for their product, and then deploy the latest build by following the instructions indicated on each of the product's Upgrade Pack page.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.