CVE-2019-19986
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary SQL SELECT statements via SQL injection in the 'persoid' parameter of the Visual Access Manager (VAM) web interface. It affects Selesta VAM versions 4.15.0 through 4.29. Attackers can extract sensitive database information through error-based SQL injection techniques.
💻 Affected Systems
- Selesta Visual Access Manager (VAM)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including extraction of all user credentials, access logs, and sensitive configuration data, potentially leading to full system takeover.
Likely Case
Extraction of user credentials, access logs, and sensitive configuration data that could enable further attacks or privilege escalation.
If Mitigated
Limited information disclosure if proper input validation and WAF rules are in place, though database errors may still leak some information.
🎯 Exploit Status
Error-based SQL injection is well-documented and easily automated. The vulnerability requires no authentication and affects a web-accessible endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.30.0 or later
Vendor Advisory: https://www.seling.it/
Restart Required: Yes
Instructions:
1. Download VAM version 4.30.0 or later from Selesta website. 2. Backup current installation and database. 3. Stop VAM services. 4. Install the updated version. 5. Restart VAM services. 6. Verify functionality.
🔧 Temporary Workarounds
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection attempts targeting the persoid parameter
# Example ModSecurity rule: SecRule ARGS:persoid "@detectSQLi" "id:1001,phase:2,deny,status:403,msg:'SQLi attempt detected'"
Input Validation Filter
allImplement input validation to restrict persoid parameter to expected numeric values only
# Example PHP validation: if(!is_numeric($_POST['persoid'])) { die('Invalid input'); }
🧯 If You Can't Patch
- Block external access to /tools/VamPersonPhoto.php via firewall rules or web server configuration
- Implement strict input validation at the application level to sanitize the persoid parameter
🔍 How to Verify
Check if Vulnerable:
Test by sending a SQL injection payload to the persoid parameter in POST/GET requests to /tools/VamPersonPhoto.php and checking for database error messages in the responseCheck Version:
Check VAM web interface login page or admin panel for version informationVerify Fix Applied:
Attempt the same SQL injection test after patching - should receive generic error or no database error messages📡 Detection & Monitoring
Log Indicators:
- Multiple requests to /tools/VamPersonPhoto.php with unusual persoid parameter values
- Database error messages in web server logs containing SQL syntax
Network Indicators:
- HTTP requests with SQL keywords in persoid parameter
- Unusual database query patterns from web server
SIEM Query:
source="web_server" AND uri="/tools/VamPersonPhoto.php" AND (persoid="*' OR *" OR persoid="*UNION*" OR persoid="*SELECT*" OR persoid="*FROM*")