Authenticated SQL Injection in ManageEngine DataSecurity Plus

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

ManageEngine DataSecurity Plus versions before 6310 contain an authenticated SQL injection vulnerability (CWE-89) in the Reports module that allows technicians with valid credentials to execute arbitrary SQL queries. This is a high-severity issue (CVSS 7.7) because it bypasses initial authentication and grants direct database access to an insider threat or compromised account holder. Organizations using DataSecurity Plus for data protection and compliance monitoring are at risk, particularly where technician accounts have broad access or where account credentials have been compromised through phishing or credential stuffing attacks.

Casky's 323 mapped skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across two MITRE ATT&CK tactics: TA0001 (Reconnaissance) and TA0043 (Exfiltration). Practitioners using Casky would see findings related to SQL injection payloads injected through the Reports module parameters, anomalous database query patterns that deviate from normal reporting operations, and lateral data movement indicating exfiltration attempts. The platform's skills would flag suspicious SQL syntax in application logs, unusual JOIN operations targeting sensitive tables, and time-based or union-based injection indicators—helping security teams distinguish malicious authenticated activity from legitimate technician behavior and prioritize forensic investigation of potentially compromised accounts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-18912.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-18912

Casky has 323 skills that investigate the attack patterns behind CVE-2026-18912. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn