CVE-2022-4961

Executive Summary

CVE-2022-4961 is a critical SQL injection vulnerability discovered in Weitong Mall version 1.0.0. The flaw resides in the platform-shop/src/main/resources/com/platform/dao/OrderDao.xml file, where the sidx and order parameters are not properly sanitized before being used in SQL queries. This allows an unauthenticated attacker to manipulate these parameters and execute arbitrary SQL commands against the underlying database. The vulnerability has a CVSS score of 5.5 (Medium), but due to the lack of authentication requirements and the potential for data exfiltration, it is considered high risk in real-world scenarios. No public exploit code or patch is currently available, and the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It is a custom Java application (Weitong Mall) with no known supply chain dependencies.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 5.5 (Medium)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exposure possible.
• Integrity Impact: Low (I:L) – limited data modification possible.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: High (due to unauthenticated remote exploitation and lack of patch).

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the MyBatis XML mapping file OrderDao.xml. The sidx (sort index) and order (sort order) parameters are likely used to dynamically construct an ORDER BY clause. In MyBatis, if these parameters are concatenated directly into the SQL statement without using parameterized queries (e.g., ${sidx} instead of #{sidx}), an attacker can inject arbitrary SQL.

Example vulnerable MyBatis snippet:

<select id="selectOrders" resultType="Order">
    SELECT * FROM orders ORDER BY ${sidx} ${order}
</select>

The attacker can supply values like:

• sidx=1; DROP TABLE users;--
• order=ASC UNION SELECT ...

This allows the attacker to execute arbitrary SQL commands, potentially extracting sensitive data (user credentials, payment info) or modifying the database.

Vulnerable vs. Patched Code

Vulnerable Code (Weitong Mall 1.0.0):

<!-- OrderDao.xml -->
<select id="selectOrders" resultType="Order">
    SELECT * FROM orders ORDER BY ${sidx} ${order}
</select>

Patched Code (Hypothetical fix):

<select id="selectOrders" resultType="Order">
    SELECT * FROM orders ORDER BY 
    <choose>
        <when test="sidx == 'id'">id</when>
        <when test="sidx == 'date'">date</when>
        <otherwise>id</otherwise>
    </choose>
    <choose>
        <when test="order == 'ASC'">ASC</when>
        <when test="order == 'DESC'">DESC</when>
        <otherwise>ASC</otherwise>
    </choose>
</select>

The fix uses a whitelist approach to validate the sidx and order parameters against a predefined set of allowed values, preventing injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Since no public exploit code is available, a manual exploitation approach is described.

Step 1: Identify the vulnerable endpoint. The vulnerable functionality is likely exposed via a REST API endpoint that accepts sidx and order parameters. Example:

GET /api/orders?page=1&rows=10&sidx=id&order=ASC

Step 2: Test for SQL injection. Inject a single quote or a time-based payload:

GET /api/orders?page=1&rows=10&sidx=id'&order=ASC

If the application returns an error or delays, it is vulnerable.

Step 3: Exploit to extract data. Use a UNION-based injection to extract database version:

GET /api/orders?page=1&rows=10&sidx=id&order=ASC UNION SELECT 1,@@version,3,4,5

Step 4: Automate with SQLMap.

sqlmap -u "http://target.com/api/orders?page=1&rows=10&sidx=id&order=ASC" --batch --dbs

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual sidx and order parameter values (e.g., containing SQL keywords, quotes, or UNION).
• Alert on database error messages returned to the client.
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Mitigation:

• Immediately apply input validation using a whitelist for sidx and order.
• Use parameterized queries (MyBatis #{}) instead of string concatenation (${}).
• If patching is not possible, restrict access to the vulnerable endpoint via network segmentation or authentication.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing sidx or order parameters with SQL keywords (e.g., UNION, SELECT, DROP, ').
  • Database error messages in HTTP responses (e.g., SQL syntax, MySQL error).
• File IOCs:
  • Modified OrderDao.xml file (if attacker attempts to persist).
• Log IOCs:
  • Database query logs showing unexpected ORDER BY clauses with injected SQL.

Detection Engineering

YARA Rule

rule CVE_2022_4961_SQLi_Weitong {
    meta:
        description = "Detects SQL injection attempts targeting Weitong Mall OrderDao.xml"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2022-4961"
    strings:
        $s1 = "sidx=" ascii nocase
        $s2 = "order=" ascii nocase
        $sql1 = "UNION" ascii nocase
        $sql2 = "SELECT" ascii nocase
        $sql3 = "DROP" ascii nocase
        $sql4 = "'" ascii
    condition:
        all of ($s1, $s2) and 1 of ($sql1, $sql2, $sql3, $sql4)
}

Sigma Rule

title: CVE-2022-4961 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts against Weitong Mall OrderDao.xml
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - 'sidx='
            - 'order='
        c-uri|contains|all:
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION in non-SQL context (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-4961 SQL Injection Attempt"; flow:to_server; content:"sidx="; http_uri; content:"order="; http_uri; pcre:"/(UNION|SELECT|DROP|'|\-\-)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: If the application is exposed to the internet, take it offline or restrict access to the vulnerable endpoint via firewall rules.
2. Code Fix: Replace ${sidx} and ${order} with whitelist validation as shown in the patched code example.
3. Input Validation: Implement strict input validation for all user-supplied parameters.
4. WAF Rules: Deploy WAF rules to block SQL injection patterns.
5. Monitoring: Enable detailed logging for database queries and web requests to detect exploitation attempts.
6. Vendor Contact: Attempt to contact Weitong for an official patch. If unresponsive, consider migrating to a different e-commerce platform.

Valters IT
Securing Digital Frontiers