CVE-2022-46501
📋 TL;DR
This SQL injection vulnerability in Accruent Maintenance Connection allows attackers to execute arbitrary SQL commands through the E-Mail to Work Order function. It affects all versions of Maintenance Connection 2021 and version 2022.2, potentially compromising database integrity and confidentiality.
💻 Affected Systems
- Accruent Maintenance Connection
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, data manipulation, privilege escalation, and potential remote code execution on the database server.
Likely Case
Unauthorized data access, data modification, and potential extraction of sensitive information from the database.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
SQL injection vulnerabilities typically have low exploitation complexity, but specific exploit details are not publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2022.3 or later
Vendor Advisory: http://accruent.com
Restart Required: Yes
Instructions:
1. Backup database and application. 2. Download and install Maintenance Connection 2022.3 or later from Accruent. 3. Restart application services. 4. Verify functionality.
🔧 Temporary Workarounds
Disable E-Mail to Work Order Function
allTemporarily disable the vulnerable feature until patching can be completed.
Implement WAF Rules
allConfigure web application firewall to block SQL injection patterns targeting the vulnerable endpoint.
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries for all database interactions
- Apply network segmentation to isolate the Maintenance Connection server from critical systems
🔍 How to Verify
Check if Vulnerable:
Check Maintenance Connection version in application settings or about dialog. If version is 2021.x or 2022.2, system is vulnerable.Check Version:
Check application version in Maintenance Connection admin interface or about dialog.Verify Fix Applied:
Verify version is 2022.3 or later and test E-Mail to Work Order function with SQL injection test payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL query patterns in database logs
- Multiple failed login attempts via email function
- Unexpected database schema changes
Network Indicators:
- Unusual database connection patterns from application server
- Large data transfers from database server
SIEM Query:
source="database_logs" AND ("UNION SELECT" OR "OR 1=1" OR "--" OR ";--")