CVE-2022-28810

CVE-2022-28810 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 7, 2023. EIP tracks 1 public exploit from researchers including Jake Baines, Hernan Diaz, Andrew Iwamaye, Dan Kelley, including a Metasploit module exploits/windows/http/manageengine_adselfservice_plus_cve_2022_28810.

AI-analyzed exploit summary This Metasploit module exploits CVE-2022-28810, an authenticated command execution vulnerability in ManageEngine ADSelfService Plus. It leverages the 'custom script' feature to execute arbitrary commands as SYSTEM when a user resets their password or unlocks their account.

Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.