CVE-2022-31961
📋 TL;DR
CVE-2022-31961 is a critical SQL injection vulnerability in Rescue Dispatch Management System v1.0 that allows attackers to execute arbitrary SQL commands via the 'id' parameter in the manage_incident.php endpoint. This affects all organizations using the vulnerable version of this emergency response management software.
💻 Affected Systems
- Rescue Dispatch Management System
📦 What is this software?
Rescue Dispatch Management System by Rescue Dispatch Management System Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive incident data, responder information, and potential authentication bypass leading to full system takeover.
Likely Case
Data exfiltration of sensitive dispatch records, responder details, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permissions restricting unauthorized access.
🎯 Exploit Status
Simple SQL injection via URL parameter. Public proof-of-concept available in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
1. Review the vulnerable code in /rdms/admin/incidents/manage_incident.php
2. Implement parameterized queries or prepared statements
3. Add input validation for the 'id' parameter
4. Test the fix thoroughly before deployment
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the vulnerable endpoint
# Example ModSecurity rule:
SecRule ARGS:id "@detectSQLi" "id:1001,phase:2,deny,status:403,msg:'SQLi attempt detected'"
# Example naxsi rule:
MainRule "str:manage_incident.php" "msg:rdms sqli" "mz:URL" "s:$SQL:4" id:1001;
Access Restriction
linuxRestrict access to the vulnerable endpoint using authentication or IP whitelisting
# Apache .htaccess example:
<Files "manage_incident.php">
Order deny,allow
Deny from all
Allow from 192.168.1.0/24
</Files>
# Nginx location block:
location /rdms/admin/incidents/manage_incident.php {
allow 192.168.1.0/24;
deny all;
}
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only
- Implement strict database user permissions with least privilege principle
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with SQL injection payload: /rdms/admin/incidents/manage_incident.php?id=1' OR '1'='1Check Version:
Check application version in admin panel or review source code headersVerify Fix Applied:
Test with same payload and verify no SQL errors or unexpected behavior occurs📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in web server logs
- Multiple requests to manage_incident.php with suspicious parameters
- Database query errors containing SQL syntax
Network Indicators:
- HTTP requests with SQL keywords in URL parameters
- Unusual traffic patterns to the vulnerable endpoint
SIEM Query:
source="web_server.logs" AND (url="*manage_incident.php*" AND (param="*id=*'*" OR param="*id=*%27*" OR param="*id=* OR *"))