CVE-2022-32012
📋 TL;DR
CVE-2022-32012 is an SQL injection vulnerability in Complete Online Job Search System v1.0 that allows attackers to execute arbitrary SQL commands via the 'id' parameter in the admin employee edit page. This affects all organizations using this specific software version. Attackers can potentially access, modify, or delete database content.
💻 Affected Systems
- Complete Online Job Search System
📦 What is this software?
Complete Online Job Search System by Complete Online Job Search System Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including credential theft, data destruction, and potential server takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized data access and modification, including extraction of sensitive employee and job applicant information, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection execution.
🎯 Exploit Status
Public proof-of-concept available on GitHub. Exploitation requires only web access to vulnerable endpoint with crafted 'id' parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Implement parameterized queries in /eris/admin/employee/index.php and validate/sanitize all user inputs.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the vulnerable endpoint
Input Validation Filter
allAdd input validation to only accept numeric values for the 'id' parameter
Add to index.php: if(!is_numeric($_GET['id'])) { die('Invalid input'); }
🧯 If You Can't Patch
- Block external access to /eris/admin/ directory via firewall or web server configuration
- Implement network segmentation to isolate the vulnerable system from sensitive databases
🔍 How to Verify
Check if Vulnerable:
Test by accessing /eris/admin/employee/index.php?view=edit&id=1' and appending SQL injection payloadsCheck Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in web server logs
- Multiple requests to /eris/admin/employee/index.php with suspicious 'id' parameters
- Database query errors containing SQL syntax
Network Indicators:
- HTTP requests with SQL keywords in URL parameters
- Unusual traffic patterns to admin endpoints
SIEM Query:
source="web_server.log" AND (url="*eris/admin/employee/index.php*" AND (param="*id=*'*" OR param="*id=*%27*" OR param="*id=*UNION*"))