CVE-2022-31384
📋 TL;DR
Directory Management System v1.0 contains a SQL injection vulnerability in the fullname parameter of add-directory.php. This allows attackers to execute arbitrary SQL commands on the database. Any organization using this specific version of the software is affected.
💻 Affected Systems
- Directory Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive directory data, potential privilege escalation, and database manipulation.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing exploitation.
🎯 Exploit Status
Public proof-of-concept available on GitHub demonstrates exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://phpgurukul.com
Restart Required: No
Instructions:
1. Check vendor website for updates. 2. If no patch, implement parameterized queries. 3. Replace raw SQL with prepared statements in add-directory.php.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and sanitization for the fullname parameter.
Modify add-directory.php to validate fullname input using PHP filter functions
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules.
Configure WAF to block SQL injection patterns in POST requests to add-directory.php
🧯 If You Can't Patch
- Implement network segmentation to isolate the vulnerable system
- Deploy intrusion detection systems monitoring for SQL injection attempts
🔍 How to Verify
Check if Vulnerable:
Test the fullname parameter in add-directory.php with SQL injection payloads like ' OR '1'='1Check Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in PHP logs
- Multiple failed login attempts following SQL payloads
Network Indicators:
- HTTP POST requests to add-directory.php containing SQL keywords like UNION, SELECT, OR
SIEM Query:
source="web_logs" AND uri="/add-directory.php" AND (request_body CONTAINS "UNION" OR request_body CONTAINS "SELECT" OR request_body CONTAINS "OR '1'='1")