CVE-2022-30335
📋 TL;DR
CVE-2022-30335 is a critical SQL injection vulnerability in Bonanza Wealth Management System (BWM) 7.3.2 that allows unauthenticated attackers to extract encrypted passwords from the database via the login form. This affects all organizations using the vulnerable version of BWM software. Attackers can potentially gain access to sensitive financial data and system credentials.
💻 Affected Systems
- Bonanza Wealth Management System (BWM)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to theft of all encrypted passwords, financial data exfiltration, and potential lateral movement to other systems if passwords are cracked or reused.
Likely Case
Attackers extract encrypted password hashes, attempt to crack them offline, and gain unauthorized access to the wealth management system and associated financial data.
If Mitigated
With proper input validation and parameterized queries, the SQL injection would be prevented, limiting impact to failed login attempts.
🎯 Exploit Status
SQL injection via login form is a well-understood attack vector with public proof-of-concept available in the referenced GitHub gist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.wealth.co.th/products/bonanza-wealth-management/
Restart Required: No
Instructions:
1. Contact vendor Wealth.co.th for patch information. 2. Check for updated versions beyond 7.3.2. 3. Apply vendor-provided security updates.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection rules to block malicious payloads at the login form.
Input Validation Filter
allImplement server-side input validation to reject SQL special characters in the username field.
🧯 If You Can't Patch
- Isolate the BWM system from internet access and restrict to internal network only.
- Implement network segmentation and monitor for unusual database queries from the application server.
🔍 How to Verify
Check if Vulnerable:
Test the login form with SQL injection payloads like ' OR '1'='1 in the username field and observe if database errors or unexpected behavior occurs.Check Version:
Check application version through admin interface or consult vendor documentation.Verify Fix Applied:
After applying fixes, attempt the same SQL injection tests and verify they are properly rejected without database errors.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts with SQL special characters
- Database queries containing UNION SELECT or other injection patterns
Network Indicators:
- Unusual outbound database connections from application server
- Traffic patterns suggesting database enumeration
SIEM Query:
source="bwm_logs" AND (message="*sql*error*" OR message="*union*select*" OR message="*' OR '*" )🔗 References
- https://gist.github.com/aliceicl/b2f25f3a0a3ba9973e4977f922d04008
- https://incognitolab.com
- https://www.wealth.co.th/products/bonanza-wealth-management/
- https://gist.github.com/aliceicl/b2f25f3a0a3ba9973e4977f922d04008
- https://incognitolab.com
- https://www.wealth.co.th/products/bonanza-wealth-management/
