CVE-2023-42235

Executive Summary

CVE-2023-42235 is an authenticated SQL injection vulnerability in Selesta Visual Access Manager (VAM), a web-based building/access management platform. An authenticated attacker can exploit unsanitized input passed to multiple parameters of the /monitor/s_normalizedtrans.php endpoint to manipulate database queries. Because the flaw is exposed only after authentication, the primary impact is data theft, credential disclosure, and potential lateral movement within systems that rely on VAM for physical access control.

Technical Analysis

The NVD description identifies the vulnerable product as Selesta Visual Access Manager prior to version 4.42.2. The vulnerable file is /monitor/s_normalizedtrans.php, and the vulnerability is classified as SQL injection affecting "multiple parameters." No additional technical detail, CWE value, CVSS vector, or patch advisory was supplied in the CNA data.

Vulnerability Mechanism

SQL injection occurs when untrusted user input is concatenated into a SQL query without proper parameterization, escaping, or stored-procedure validation. In this case, an authenticated user can supply malicious SQL fragments through one or more query string or POST parameters used by s_normalizedtrans.php. The application likely constructs SQL statements dynamically from these parameters and executes them against a backend database containing VAM configuration data.

Given the /monitor/ directory prefix, this endpoint probably belongs to the monitoring subsystem of VAM — possibly a normalized-transactions viewer used by administrators or operators. The endpoint may accept date ranges, filtering values, or transaction identifiers. The phrase "multiple parameters" suggests the injection is not limited to a single input field; several parameters reach the SQL engine unsafely. This increases the attack surface and makes detection more challenging because defensive rules must inspect all request parameters rather than a single known parameter name.

Attack Surface

The attack surface is restricted to an already-authenticated session. This lowers the likelihood of opportunistic internet-wide scanning, but it also means that any legitimate user with access to the VAM web console — including low-privileged operators — can attempt exploitation. If VAM is exposed to the internet or to a broadly segmented corporate network, the effective attack surface expands to include any compromised or malicious employee account.

Technical Limitations in Public Data

The public record for CVE-2023-42235 does not include specific parameter names, SQL syntax examples, GET vs. POST request structure, database backend, or proof-of-concept code. This report therefore describes the exploitation at the vulnerability-class level. No function names, class names, or API endpoints beyond /monitor/s_normalizedtrans.php are used because none were provided in the authoritative CNA description.

Exploitation Scenarios

The following attack chain is derived strictly from the NVD description, the authenticated nature of the vulnerability, and the known behavior of SQL injection against web-based management consoles. No public exploit code is available, so the scenario is inferred from the vulnerability class.

Step 1 — Reconnaissance and Target Identification

An attacker first identifies accessible Selesta VAM instances. Because authentication is required, the attacker also needs a valid account. Reconnaissance methods include:

• Using search engines and Shodan-style queries to locate Visual Access Manager login pages.
• Scanning for the /monitor/s_normalizedtrans.php path on both internal and external web services.
• Enumerating user roles and credentials through phishing, password spraying, or credential reuse. Since VAM manages physical access, default credentials or weak operator passwords are a plausible entry vector.

Step 2 — Authenticated Access and Endpoint Discovery

Once a valid account is obtained, the attacker logs into VAM and navigates to, or directly requests, /monitor/s_normalizedtrans.php. Because the endpoint is part of the application’s authenticated surface, it may be linked from monitoring dashboards or may be referenced in browser history, application JavaScript, or public documentation. Direct access may also work if the endpoint does not enforce role-based authorization and merely checks that the user is logged in.

Step 3 — SQL Injection Trigger

The attacker begins injecting SQL metacharacters and malicious database statements into the endpoint’s parameters. Example payload classes that apply to this vulnerability include:

• Single-quote (') or escape sequences to break out of string literals and induce database syntax errors.
• UNION SELECT statements to retrieve arbitrary data alongside legitimate query results.
• Boolean-based blind injection using conditions such as AND 1=1 versus AND 1=2 to infer database contents from response differences.
• Time-based delay functions such as WAITFOR DELAY or BENCHMARK to confirm injection when no error or result is returned.

The exact parameter names are not disclosed, but because the NVD description states that multiple parameters are vulnerable, an attacker can iterate across all query string and POST body parameters accepted by /monitor/s_normalizedtrans.php.

Step 4 — Post-Exploitation Impact

Successful exploitation can yield:

• Extraction of VAM user account names, password hashes, and role assignments.
• Disclosure of building access schedules, door mappings, security zones, and cardholder data.
• Modification or deletion of access control records if the database user has write permissions, potentially disabling locks or granting unauthorized physical access.
• Potential operating-system-level compromise if the database server runs with elevated privileges and supports xp_cmdshell, COPY ... FROM PROGRAM, or equivalent features.

The impact extends beyond digital data because VAM integrates with physical security systems. An attacker who extracts credentials and modifies access rules can affect physical premises security.

Impact Assessment

No CVSS v3 vector or base score is available for CVE-2023-42235, so a precise severity rating cannot be produced. However, the security impact can be assessed qualitatively:

• Confidentiality Impact: High. An authenticated attacker can extract database contents, including user credentials and sensitive physical security configuration.
• Integrity Impact: Medium to High. Depending on database privileges, an attacker may alter or delete access-control rules, schedules, and user records.
• Availability Impact: Medium. SQL injection can be used to issue resource-intensive queries or to corrupt or lock database records, potentially disrupting VAM monitoring and physical access operations.
• Authentication Requirement: The vulnerability requires an authenticated session. This lowers the AV score in a CVSS model but does not meaningfully reduce the importance of the vulnerability for enterprise security teams, since many VAM users are low-privileged operators.

The blast radius is significant for organizations that operate Selesta VAM as a central physical access management platform. Compromise of VAM databases may also expose directory integration credentials, Active Directory service account credentials, and encrypted cardholder data. Because the product is designed for physical security, exploitation can bridge the cyber-physical gap.

Detection Guidance

The following detection content targets the endpoint path /monitor/s_normalizedtrans.php combined with common SQL injection payload indicators. Because the exact vulnerable parameters are unknown, the rules look for SQL metacharacters and known SQL keywords in the request. Tune and test these rules against your environment to reduce false positives.

Sigma Rule

title: SQL Injection Attempt Against Selesta VAM s_normalizedtrans.php
id: b3e7c4f2-5a0e-4f1e-9c1d-2e2c3d4a5b6c
status: experimental
description: Detects SQL injection patterns in HTTP requests targeting the Selesta Visual Access Manager vulnerable endpoint.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-42235
author: Valtersit Threat Intelligence
date: 2025/04/16
logsource:
    category: webserver
    product: apache
    definition: Web server access logs that include request URI and query string.
detection:
    selection_path:
        c-uri|contains: '/monitor/s_normalizedtrans.php'
    selection_sqli:
        c-uri|contains:
            - "'"
            - '"'
            - ' UNION '
            - 'SELECT'
            - 'information_schema'
            - 'WAITFOR'
            - 'BENCHMARK'
            - '--'
            - '/*'
    condition: selection_path and selection_sqli
falsepositives:
    - Legitimate requests that accidentally contain SQL keywords (e.g., transaction search for a value named "SELECT").
level: high

YARA Rule

rule CVE_2023_42235_Selesta_VAM_SQLi
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects SQL injection payloads or indicators targeting Selesta Visual Access Manager s_normalizedtrans.php"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-42235"
        date = "2025-04-16"
    strings:
        $endpoint = "/monitor/s_normalizedtrans.php" ascii wide
        $sqli1 = "UNION SELECT" ascii wide
        $sqli2 = "UNION ALL SELECT" ascii wide
        $sqli3 = "information_schema" ascii wide
        $sqli4 = "WAITFOR DELAY" ascii wide
        $sqli5 = "BENCHMARK(" ascii wide
        $sqli6 = " OR 1=1" ascii wide
        $sqli7 = "';--" ascii wide
        $sqli8 = "/*" ascii wide
    condition:
        $endpoint and 2 of ($sqli*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2023-42235 Selesta VAM SQL Injection Attempt"; flow:established,to_server; http.uri; content:"/monitor/s_normalizedtrans.php"; http.uri; content:"'"; http.uri; content:"UNION"; nocase; fast_pattern; http.uri; content:"SELECT"; nocase; distance:0; reference:cve,2023-42235; classtype:web-application-attack; sid:202342235; rev:1;)

Elastic Detection

any where url.path == "/monitor/s_normalizedtrans.php" and (
    url.query like "*'*" or
    url.query like "*UNION*" or
    url.query like "*SELECT*" or
    url.query like "*information_schema*" or
    url.query like "*--*" or
    url.query like "*WAITFOR*"
)

Splunk SPL Query

index=web sourcetype=access_combined
    uri_path="/monitor/s_normalizedtrans.php"
    (uri_query="*'*" OR uri_query="*UNION*" OR uri_query="*SELECT*" OR uri_query="*information_schema*" OR uri_query="*--*" OR uri_query="*WAITFOR*")
| stats count earliest(_time) latest(_time) values(uri_query) by src_ip dest_ip http_method uri_path
| rename src_ip as "Source IP", dest_ip as "Dest IP", http_method as "HTTP Method", uri_path as "URI Path", uri_query as "Query String"

Wazuh OSSEC Rule

<group name="sql_injection,selesta,">
  <rule id="100423" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.php</field>
    <match>s_normalizedtrans\.php</match>
    <regex>UNION|SELECT|information_schema|WAITFOR|BENCHMARK|OR\s+1=1|--</regex>
    <description>CVE-2023-42235: Possible SQL injection against Selesta VAM s_normalizedtrans.php</description>
    <group>web_application_attack,sql_injection,</group>
    <mitre><id>T1190</id></mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor patch advisory was identified by any tracked source. The NVD description states the product is affected prior to version 4.42.2, which implies that version 4.42.2 may contain a fix, but no official advisory or patch confirmation was available at the time of writing.

1) Immediate Mitigations

• Restrict access to VAM web interfaces. Do not expose /monitor/ endpoints to the internet. Use VPNs, jump hosts, or dedicated management VLANs.
• Enforce strong authentication and multi-factor authentication (MFA) for all VAM user accounts. This reduces the likelihood of credential compromise leading to authenticated exploitation.
• Apply least-privilege principles to VAM accounts. Do not grant operator-level accounts direct access to monitoring endpoints unless required.
• Deploy a web application firewall (WAF) in front of VAM with rules that block SQL metacharacters and SQL keywords in query parameters.
• Monitor all access to /monitor/s_normalizedtrans.php and alert on any request containing SQL syntax.
• If possible, enforce database-level least privilege so the VAM application account cannot read or modify sensitive tables outside its core function.

2) Patch/Upgrade Steps

• Confirm with Selesta whether version 4.42.2 or a later release contains an official fix for CVE-2023-42235.
• If a patched version is available, upgrade VAM immediately after testing the release in an isolated staging environment.
• If version 4.42.2 is not a genuine fix, continue monitoring vendor security advisories for a patched build.
• Until a verified patch is installed, treat the application as vulnerable and apply compensating controls continuously.

3) Long-Term Hardening

• Request that the vendor provide public disclosure of all vulnerable parameters and the specific SQL injection remediation implemented.
• Integrate the VAM web application into application security testing pipelines. Run dynamic and static analysis against the web console during every upgrade cycle.
• Segment VAM databases from general business networks and enforce encrypted links between the application and database layers.
• Retain and analyze web access logs for at least 12 months to support incident investigation and forensic analysis.
• Develop an incident response playbook for physical access control system compromise, including procedures for revoking physical credentials and locking affected doors.

References

1. NVD Entry — CVE-2023-42235: https://nvd.nist.gov/vuln/detail/CVE-2023-42235
2. Selesta Product Site — Visual Access Manager: https://www.selesta.it/ (vendor homepage; no specific advisory identified)
3. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2023-42235 is NOT listed)

No public proof-of-concept, Nuclei template, exploit code, or in-the-wild campaign evidence was available for CVE-2023-42235 at the time of writing. The exploitation scenario in this report is inferred from the vulnerability class and the authenticated attack context described in the NVD record.