Critical Zoho Analytics Plus Flaw Allows Attackers to Run Arbitrary SQL Queries

A critical unauthenticated SQL injection vulnerability has been discovered in Zoho Analytics Plus on-premise, tracked as CVE-2025-8324, which allows attackers to run arbitrary SQL queries without authentication. The flaw stems from insufficient input validation in Analytics Plus on-premises builds before 6170, enabling remote exploitation by unauthenticated threat actors and potentially leading to data exposure and account takeovers.

Affected versions include builds below 6170, with Build 6171 released as the fixed version that enforces strict URL restrictions and removes insecure code. Organisations are urged to upgrade to Build 6171 to mitigate the risk, and the upgrade process involves downloading the latest service pack from ManageEngine and following installation instructions.

Given the unauthenticated nature and critical severity, exploitation could be active if left unpatched, and organisations should audit their systems for potential exploitation before patching, while seeking technical support for the upgrade. According to ManageEngine, affected organisations should prioritise this update to prevent widespread compromise.