CVE-2022-31964
📋 TL;DR
CVE-2022-31964 is a critical SQL injection vulnerability in Rescue Dispatch Management System v1.0 that allows attackers to execute arbitrary SQL commands via the 'id' parameter in the respondent_types management page. This affects all organizations using the vulnerable software version. Attackers can potentially access, modify, or delete database contents.
💻 Affected Systems
- Rescue Dispatch Management System
📦 What is this software?
Rescue Dispatch Management System by Rescue Dispatch Management System Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution on the database server.
Likely Case
Unauthorized data access and extraction of sensitive information including user credentials, personal data, and system configuration.
If Mitigated
Limited impact with proper input validation and database permissions restricting attacker to read-only operations on non-sensitive data.
🎯 Exploit Status
Exploitation requires admin access to reach the vulnerable endpoint. SQL injection is straightforward with publicly available proof-of-concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
No official patch available. Apply workarounds or implement custom fixes with parameterized queries and input validation.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block SQL injection patterns targeting the vulnerable endpoint
Input Validation Filter
allAdd server-side validation to sanitize 'id' parameter to accept only numeric values
Modify view_respondent_type.php to add: if(!is_numeric($_GET['id'])) { die('Invalid input'); }
🧯 If You Can't Patch
- Restrict access to /rdms/admin/ directory using IP whitelisting or authentication requirements
- Implement database user with minimal permissions (read-only if possible) for the application
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with SQL injection payloads: /rdms/admin/respondent_types/view_respondent_type.php?id=1' OR '1'='1Check Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Test with same payloads and verify they are rejected or sanitized without executing SQL📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple requests to view_respondent_type.php with suspicious parameters
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, etc.) in URL parameters
SIEM Query:
source="web_server" AND (url="*view_respondent_type.php*" AND (param="*' OR*" OR param="*UNION*" OR param="*SELECT*"))