CVE-2023-42244
📋 TL;DR
This vulnerability allows authenticated attackers to perform SQL injection attacks through multiple POST parameters in the /vam/vam_visits.php endpoint of Selesta Visual Access Manager. Attackers could potentially access, modify, or delete database information. Organizations running VAM versions prior to 4.42.2 are affected.
💻 Affected Systems
- Selesta Visual Access Manager (VAM)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, or system takeover
Likely Case
Unauthorized data access and potential data manipulation
If Mitigated
Limited impact with proper input validation and database permissions
🎯 Exploit Status
Requires authentication and knowledge of vulnerable parameters
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.42.2 or later
Vendor Advisory: https://gitlab.com/daniele_m/cve-list/-/blob/main/README.md
Restart Required: No
Instructions:
1. Download VAM version 4.42.2 or later from official sources. 2. Follow vendor upgrade procedures. 3. Verify the patch is applied successfully.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for POST parameters in vam_visits.php
Web Application Firewall
allDeploy WAF with SQL injection protection rules
🧯 If You Can't Patch
- Restrict access to /vam/vam_visits.php endpoint using network controls
- Implement database user with minimal required permissions
🔍 How to Verify
Check if Vulnerable:
Check VAM version in admin interface or configuration filesCheck Version:
Check VAM web interface admin panel or configuration files for version informationVerify Fix Applied:
Verify version is 4.42.2 or later and test SQL injection attempts are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple POST requests to vam_visits.php with SQL-like parameters
Network Indicators:
- SQL injection patterns in HTTP POST requests to /vam/vam_visits.php
SIEM Query:
source="web_logs" AND uri="/vam/vam_visits.php" AND (post_param CONTAINS "' OR" OR post_param CONTAINS "UNION" OR post_param CONTAINS "SELECT *")