CVE-2022-0362
📋 TL;DR
CVE-2022-0362 is a critical SQL injection vulnerability in showdoc documentation software that allows attackers to execute arbitrary SQL commands. This affects all showdoc installations prior to version 2.10.3. Attackers can potentially access, modify, or delete database content through this vulnerability.
💻 Affected Systems
- showdoc/showdoc
📦 What is this software?
Showdoc by Showdoc
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining
Likely Case
Unauthorized database access allowing extraction of sensitive information, user credentials, and documentation content
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data
🎯 Exploit Status
SQL injection requires authentication but is straightforward to exploit once authenticated
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.10.3
Vendor Advisory: https://github.com/star7th/showdoc/commit/2b34e267e4186125f99bfa420140634ad45801fb
Restart Required: Yes
Instructions:
1. Backup your showdoc installation and database. 2. Update to showdoc version 2.10.3 or later via git pull or package update. 3. Restart the showdoc service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for all user-controlled parameters in SQL queries
Database Permission Reduction
allRestrict database user permissions to minimum required operations
🧯 If You Can't Patch
- Implement web application firewall (WAF) with SQL injection protection rules
- Isolate showdoc instance behind authentication proxy with strict access controls
🔍 How to Verify
Check if Vulnerable:
Check showdoc version in admin panel or by examining the installation directory for version filesCheck Version:
Check showdoc admin interface or examine showdoc/version.txt fileVerify Fix Applied:
Confirm version is 2.10.3 or later and test SQL injection attempts are properly blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL query patterns in database logs
- Multiple failed login attempts followed by SQL-like payloads in access logs
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, INSERT, etc.) in parameters
SIEM Query:
source="web_access_logs" AND (SELECT OR UNION OR INSERT OR DELETE) AND uri_path="/showdoc/*"