Zohocorp ManageEngine PAM360 versions prior to 8531 and ManageEngine Password Manager Pro versions from 8600 through 13230 contain an authenticated SQL injection flaw in the query report module. The vulnerability allows a user with valid credentials to inject malicious SQL statements, potentially leading to unauthorized data exfiltration, data modification, or other database compromise. This weakness is a classic example of CWE‑89, where unsanitized input is executed by the database engine.

Affected products include Zohocorp’s ManageEngine PAM360 (any release before 8531) and ManageEngine Password Manager Pro (releases 8600 through 13230). These versions are vulnerable when accessed via the query report module, which requires authentication to use.

The CVSS score of 8.1 classifies the vulnerability as high severity. The EPSS score is unavailable, and the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is authenticated, requiring legitimate user credentials to exploit. Once authenticated, an attacker can execute arbitrary SQL against the backend database, potentially compromising confidentiality, integrity, and availability of stored credentials and audit data.