CVE-2022-30413
📋 TL;DR
CVE-2022-30413 is a critical SQL injection vulnerability in Covid-19 Travel Pass Management System v1.0 that allows attackers to execute arbitrary SQL commands via the delete_application function. This affects all organizations using this specific travel pass management software. Attackers can potentially access, modify, or delete sensitive database information.
💻 Affected Systems
- Covid-19 Travel Pass Management System
📦 What is this software?
Covid 19 Travel Pass Management System by Covid 19 Travel Pass Management System Project
View all CVEs affecting Covid 19 Travel Pass Management System →
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution on the database server.
Likely Case
Unauthorized access to sensitive personal and travel data, including COVID test results, personal identification information, and travel records.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
Public proof-of-concept available on GitHub showing SQL injection via the delete_application parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Implement input validation and parameterized queries in the Master.php file, specifically in the delete_application function.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the delete_application parameter
Input Validation Filter
allAdd input validation to sanitize the delete_application parameter before processing
🧯 If You Can't Patch
- Isolate the vulnerable system behind a reverse proxy with strict input filtering
- Implement network segmentation to limit database access from the application server
🔍 How to Verify
Check if Vulnerable:
Test the /ctpms/classes/Master.php?f=delete_application endpoint with SQL injection payloads like ' OR '1'='1Check Version:
Check application version in configuration files or admin panelVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed delete_application requests with SQL syntax
Network Indicators:
- HTTP requests to Master.php with SQL keywords in parameters
- Unusual database query patterns from application server
SIEM Query:
source="web_logs" AND uri="/ctpms/classes/Master.php" AND (param="delete_application" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "OR")