CVE-2022-31951
📋 TL;DR
Rescue Dispatch Management System v1.0 contains a SQL injection vulnerability in the delete_respondent_type function that allows attackers to execute arbitrary SQL commands. This affects all users running the vulnerable version of this web application. Attackers can potentially access, modify, or delete database contents.
💻 Affected Systems
- Rescue Dispatch Management System
📦 What is this software?
Rescue Dispatch Management System by Rescue Dispatch Management System Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized data access and modification, potentially exposing sensitive information about dispatch operations and personnel.
If Mitigated
Limited impact with proper input validation and database permissions, though SQL injection attempts would still be logged.
🎯 Exploit Status
The GitHub reference shows detailed exploitation steps, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Parameterized Queries
allImplement proper input validation and use parameterized queries/prepared statements in the Master.php file.
Modify /rdms/classes/Master.php to use prepared statements for all database operations
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules to block malicious requests.
Configure WAF rules to block SQL injection patterns targeting the vulnerable endpoint
🧯 If You Can't Patch
- Restrict access to the vulnerable endpoint using network controls or authentication
- Implement database-level controls with minimal necessary permissions for the application user
🔍 How to Verify
Check if Vulnerable:
Test the endpoint /rdms/classes/Master.php?f=delete_respondent_type with SQL injection payloads like ' OR '1'='1Check Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Test the same endpoint with SQL injection payloads and verify they are rejected or properly handled📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to Master.php with suspicious parameters
- Database error messages containing SQL syntax
Network Indicators:
- HTTP requests to /rdms/classes/Master.php with SQL keywords in parameters
- Unusual database query patterns from the application server
SIEM Query:
source="web_server" AND uri="/rdms/classes/Master.php" AND (param="delete_respondent_type" AND (query="' OR" OR query="UNION" OR query="SELECT"))