[R1] ManageEngine ADAudit Plus Multiple Vulnerabilities

During the course of Nessus plugin development, Tenable discovered several issues in ADAudit Plus:

1. A Cross-site Request Forgery (CSRF) vulnerability that allows for the creation of an arbitrary administrative account, if a currently authenticated administrator is tricked into clicking a link. The issue is due to the /TechnicianConfiguration.do script not requiring multiple steps, explicit confirmation, or a unique token when performing actions related to the script. This can be used to create an arbitrary account with administrative privileges.
2. Multiple stored cross-site scripting (XSS) issues. Note that these are likely considered lower risk, as they require administrative authentication. However, not all administrators of an application are presumed to have the permissions and information that can be gained from such an attack.
1. SaveMonitor.do MONITOR_NAME parameter
2. UpdateMonitor.do MONITOR_NAME parameter
3. SaveAlertProfile.do ALERT_PROFILE_NAME parameter
4. UpdateAlertProfile.do ALERT_PROFILE_NAME parameter
5. CreateCustomReport.do customReportName parameter
6. SaveAuditAction.do ACTION_NAME and ACTION_DESCRIPTION parameters
7. CreateScheduler.do scheduleName parameter
3. A remote privilege escalation vulnerability that can be performed with the absolute least privileged account (e.g. 'Nothing' permissions with only read access), to gain full administrative access to the application. The issue is due to the /TechnicianConfiguration.do script not properly checking for user privileges, allowing any user to create a new administrative account.
4. The web interface installs with default administrative credentials (admin/admin).