CVE-2022-47072
📋 TL;DR
This SQL injection vulnerability in Enterprise Architect allows attackers to execute arbitrary SQL commands through the Find parameter in the Select Classifier dialog box. Attackers could potentially read, modify, or delete database contents. Organizations using Enterprise Architect 16.0.1605 32-bit are affected.
💻 Affected Systems
- Enterprise Architect
📦 What is this software?
Enterprise Architect by Sparxsystems
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Enterprise Architect database, including data theft, data destruction, or full system takeover through SQL command execution leading to remote code execution.
Likely Case
Unauthorized data access and modification, potential extraction of sensitive project information, and database corruption.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing without modification.
🎯 Exploit Status
Proof of concept code is publicly available on GitHub. Exploitation requires access to the Enterprise Architect application interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 16.1 or later
Vendor Advisory: https://sparxsystems.com/support/
Restart Required: Yes
Instructions:
1. Download the latest version of Enterprise Architect from the official Sparx Systems website. 2. Install the update following the vendor's installation instructions. 3. Restart the application to apply the fix.
🔧 Temporary Workarounds
Input Validation Implementation
allImplement custom input validation for the Find parameter to sanitize SQL special characters
Database Permission Restriction
allRestrict database user permissions to read-only access for the Enterprise Architect application account
🧯 If You Can't Patch
- Disable or restrict access to the Select Classifier dialog box functionality
- Implement network segmentation to isolate Enterprise Architect systems from critical databases
🔍 How to Verify
Check if Vulnerable:
Check if Enterprise Architect version is 16.0.1605 32-bit via Help > About menuCheck Version:
Not applicable - check via application interfaceVerify Fix Applied:
Verify version is 16.1 or later in Help > About menu📡 Detection & Monitoring
Log Indicators:
- Unusual SQL query patterns in database logs
- Multiple failed login attempts or unusual access patterns
Network Indicators:
- Unusual database connection patterns from Enterprise Architect systems
SIEM Query:
source="database_logs" AND (sql_injection_indicators OR unusual_query_patterns)