CVE-2022-30411
📋 TL;DR
CVE-2022-30411 is an SQL injection vulnerability in Covid-19 Travel Pass Management System v1.0 that allows attackers to execute arbitrary SQL commands via the 'id' parameter in the admin interface. This affects all organizations using this specific travel pass management software. Attackers could potentially access, modify, or delete sensitive travel and personal data.
💻 Affected Systems
- Covid-19 Travel Pass Management System
📦 What is this software?
Covid 19 Travel Pass Management System by Covid 19 Travel Pass Management System Project
View all CVEs affecting Covid 19 Travel Pass Management System →
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive personal and travel data, including PII, vaccination records, and travel documents.
If Mitigated
Limited impact with proper input validation, parameterized queries, and WAF protection in place.
🎯 Exploit Status
Exploit requires access to admin interface but SQL injection is straightforward via URL parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for the 'id' parameter to only accept expected data types
Modify PHP code to validate id parameter: if(!is_numeric($_GET['id'])) { die('Invalid input'); }
Parameterized Queries Implementation
allReplace dynamic SQL queries with prepared statements using PDO or MySQLi
$stmt = $pdo->prepare('SELECT * FROM individuals WHERE id = ?'); $stmt->execute([$id]);
🧯 If You Can't Patch
- Deploy Web Application Firewall (WAF) with SQL injection protection rules
- Restrict access to admin interface using IP whitelisting and strong authentication
🔍 How to Verify
Check if Vulnerable:
Test the vulnerable endpoint: /ctpms/admin/?page=individuals/view_individual&id=1' OR '1'='1Check Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Test with SQL injection payloads and verify they are rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in logs
- Multiple failed parameter manipulation attempts
- Admin panel access from unusual IPs
Network Indicators:
- HTTP requests with SQL keywords in URL parameters
- Unusual database query patterns
SIEM Query:
source="web_logs" AND (url="*view_individual*" AND (param="*id=*'*" OR param="*id=* OR *" OR param="*id=* UNION *"))