CVE-2022-2019
📋 TL;DR
This critical vulnerability in Prison Management System 1.0 allows attackers to bypass authorization controls during new user creation. Attackers can remotely exploit this to create unauthorized user accounts with elevated privileges. Organizations using this software are affected.
💻 Affected Systems
- SourceCodester Prison Management System
📦 What is this software?
Prison Management System by Prison Management System Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers create administrative accounts, gaining full control over the prison management system to access sensitive inmate data, modify records, or disrupt operations.
Likely Case
Attackers create unauthorized user accounts to access confidential information or perform unauthorized actions within the system.
If Mitigated
With proper network segmentation and access controls, impact is limited to the application layer with no lateral movement.
🎯 Exploit Status
Exploit details are publicly available; requires some authentication but authorization bypass allows privilege escalation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Access Control Hardening
allImplement strict authorization checks in /classes/Users.php to validate user permissions before allowing user creation.
Web Application Firewall Rules
allDeploy WAF rules to block unauthorized requests to /classes/Users.php?f=save endpoint.
🧯 If You Can't Patch
- Isolate the application behind a reverse proxy with strict authentication requirements
- Implement network segmentation to limit access to the application from trusted networks only
🔍 How to Verify
Check if Vulnerable:
Test if unauthorized users can access /classes/Users.php?f=save endpoint and create new accounts without proper permissions.Check Version:
Check application version in admin panel or configuration files; look for version 1.0.Verify Fix Applied:
Verify that proper authorization checks are implemented and only authorized users can create new accounts.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authorization attempts followed by successful user creation
- User creation requests from unexpected IP addresses
Network Indicators:
- Unusual POST requests to /classes/Users.php?f=save
- Traffic patterns showing user creation outside normal business hours
SIEM Query:
source="web_logs" AND (url="/classes/Users.php?f=save" AND status=200) AND NOT user_role="admin"