CVE-2022-45030
📋 TL;DR
This SQL injection vulnerability in rConfig 3.9.7 allows attackers to execute arbitrary SQL commands via the 'command' parameter in ajaxCompareGetCmdDates.php. This could lead to unauthorized data access, modification, or deletion. All users running rConfig 3.9.7 are affected.
💻 Affected Systems
- rConfig
📦 What is this software?
Rconfig by Rconfig
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive configuration data, credential theft, and potential remote code execution via secure-file-priv interaction.
Likely Case
Unauthorized access to network device configurations, credential extraction, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permissions restricting file operations.
🎯 Exploit Status
Public exploit code is available, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd proper input validation and parameterized queries to the vulnerable PHP file.
Edit lib/ajaxHandlers/ajaxCompareGetCmdDates.php to use prepared statements with PDO or mysqli
Access Restriction
linuxRestrict access to the vulnerable endpoint via web server configuration.
Add 'Deny from all' to .htaccess for the ajaxHandlers directory or configure nginx location block
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns targeting the vulnerable endpoint
- Restrict database user permissions to prevent file operations and limit damage from successful exploitation
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with SQL injection payloads: /lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command=1' OR '1'='1Check Version:
Check rConfig version in web interface or configuration filesVerify Fix Applied:
Verify that SQL injection payloads no longer return database information and that prepared statements are implemented📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to ajaxCompareGetCmdDates.php with SQL syntax
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, etc.) targeting the vulnerable endpoint
SIEM Query:
source="web_logs" AND uri="/lib/ajaxHandlers/ajaxCompareGetCmdDates.php" AND (request CONTAINS "UNION" OR request CONTAINS "SELECT" OR request CONTAINS "' OR '")