Authenticated users of Zohocorp ManageEngine ADSelfService Plus can exploit a flaw in the search report option to inject arbitrary SQL. The vulnerability allows attackers to read, modify, or delete sensitive data stored in the database, potentially leading to a compromise of confidentiality and integrity of user information. While the exact damage depends on the privileges of the attacker, the impact includes unauthorized data access and possible manipulation of system configuration.

The flaw affects ManageEngine ADSelfService Plus versions 6522 and earlier. These releases are bundled under the Zohocorp vendor, and the issue is not present in newer versions released after 6522.

With a CVSS score of 8.3, the vulnerability is considered high severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. The likely attack vector requires authentication and access to the search report feature, so only users with legitimate credentials and sufficient privileges can target the system.