CVE-2022-31957
📋 TL;DR
Rescue Dispatch Management System v1.0 contains a SQL injection vulnerability in the admin teams view page that allows attackers to execute arbitrary SQL commands. This affects all deployments of this specific software version. Attackers can potentially access, modify, or delete database content through this vulnerability.
💻 Affected Systems
- Rescue Dispatch Management System
📦 What is this software?
Rescue Dispatch Management System by Rescue Dispatch Management System Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized data access and extraction of sensitive information from the database, potentially including user credentials and operational data.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploitation requires access to the admin interface but SQL injection is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Implement parameterized queries or input validation in rdms/admin/teams/view_team.php.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd input validation to the id parameter in view_team.php to only accept expected values
Modify PHP code to validate/sanitize $_GET['id'] parameter
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the vulnerable endpoint
Configure WAF to block requests containing SQL keywords to /rdms/admin/teams/view_team.php
🧯 If You Can't Patch
- Restrict access to /rdms/admin/ directory using network controls or authentication
- Implement database user with minimal permissions for the application
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with SQL injection payloads: /rdms/admin/teams/view_team.php?id=1' OR '1'='1Check Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Test with same payloads and verify they are rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to view_team.php with suspicious parameters
Network Indicators:
- HTTP requests to vulnerable endpoint containing SQL keywords
- Abnormal database query patterns
SIEM Query:
source="web_logs" AND uri="/rdms/admin/teams/view_team.php" AND (param="id" AND value MATCHES "'.*OR.*|'.*AND.*|'.*UNION.*")