CVE-2022-40347 – This CVE describes an unauthenticated SQL injec... (How to Fix)

Q: What is the severity of CVE-2022-40347?

CVE-2022-40347 has a CVSS score of 9.8 (CRITICAL). This CVE describes an unauthenticated SQL injection vulnerability in Intern Record System version 1.0. Attackers can exploit parameters in the controller.php file to execute arbitrary SQL commands, potentially gaining access to sensitive database information or system control. Any organization using this specific version of the software is affected.

📋 TL;DR

This CVE describes an unauthenticated SQL injection vulnerability in Intern Record System version 1.0. Attackers can exploit parameters in the controller.php file to execute arbitrary SQL commands, potentially gaining access to sensitive database information or system control. Any organization using this specific version of the software is affected.

💻 Affected Systems

Products:

Intern Record System

Versions: 1.0

Operating Systems: Any OS running PHP

Default Config Vulnerable: ⚠️ Yes

Notes: The vulnerability exists in the default installation with no special configuration required.

📦 What is this software?

Intern Record System by Intern Record System Project

View all CVEs affecting Intern Record System →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise leading to data theft, privilege escalation, remote code execution, and full system takeover.

🟠

Likely Case

Database information disclosure including user credentials, personal data, and system information that could enable further attacks.

🟢

If Mitigated

Limited impact with proper input validation and parameterized queries preventing SQL injection.

🌐 Internet-Facing: HIGH - The vulnerability is unauthenticated and exploitable remotely via web requests.

🏢 Internal Only: HIGH - Even internal systems are vulnerable to authenticated or unauthenticated attackers within the network.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Multiple public exploit scripts and detailed analysis available on GitHub and Packet Storm Security.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Not available

Vendor Advisory: Not available

Restart Required: No

Instructions:

No official patch exists. Replace vulnerable code with parameterized queries and input validation.

🔧 Temporary Workarounds

Input Validation and Sanitization

all

Implement strict input validation and sanitization for phone, email, deptType, and name parameters

Modify /intern/controller.php to use prepared statements with parameterized queries

Web Application Firewall (WAF)

all

Deploy WAF rules to block SQL injection patterns

Configure WAF to detect and block SQL injection attempts in POST/GET parameters

🧯 If You Can't Patch

Isolate the system behind a reverse proxy with strict input filtering
Implement network segmentation to limit database access from the application server

🔍 How to Verify

Check if Vulnerable:

Test the /intern/controller.php endpoint with SQL injection payloads in phone, email, deptType, or name parameters

Check Version:

Check PHP files for version comments or review source code structure

Verify Fix Applied:

Verify that parameterized queries are implemented and test with SQL injection payloads that should be rejected

📡 Detection & Monitoring

Log Indicators:

Unusual SQL error messages in application logs
Multiple failed login attempts with SQL syntax in parameters
Unexpected database queries from application user

Network Indicators:

HTTP requests containing SQL keywords (SELECT, UNION, DROP, etc.) in parameters
Unusual database connection patterns from application server

SIEM Query:

source="web_logs" AND ("SELECT" OR "UNION" OR "DROP" OR "INSERT" OR "UPDATE") AND uri="/intern/controller.php"

📊 Metadata

CVE ID: CVE-2022-40347

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

Published: February 17, 2023

Last Updated: March 18, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-40347, you might also want to check these: