CVE-2023-42236

Executive Summary

CVE-2023-42236 is an authenticated SQL Injection vulnerability in Selesta Visual Access Manager (VAM) versions prior to 4.42.2. An authenticated attacker can inject arbitrary SQL through a GET parameter handled by the /common/ajaxfunction.php endpoint, leading to unauthorized read, modification, or deletion of data in the underlying database. Affected organizations are those running Selesta VAM deployments below version 4.42.2; the CVSS score is N/A as no vector has been published by NVD, and the vendor patch status remains unconfirmed.

Technical Analysis

The vulnerability resides in Selesta Visual Access Manager (VAM), a web-based access management application. According to the NVD description, the flaw is an SQL Injection condition reachable by an already-authenticated attacker through a GET parameter of the endpoint /common/ajaxfunction.php. The NVD description does not disclose the specific parameter name, the affected query structure, or the database backend; therefore, the precise injection point and syntax cannot be confirmed from authoritative sources.

At the vulnerability-class level, SQL Injection (CWE-89) occurs when user-supplied input is concatenated into an SQL statement without adequate parameterization, escaping, or validation. In this case, the application receives a GET request at /common/ajaxfunction.php, and one or more query-string parameters are embedded into a SQL command. Because the request uses the GET method, the payload is transmitted in the URL line, which has two security-relevant consequences: (1) the injection is trivial to replay and automate, and (2) the payload will appear verbatim in web server access logs, proxy logs, and WAF logs, which is a favorable property for detection.

The requirement for authentication is significant. The attacker must already possess valid credentials for the VAM application, which raises the barrier to entry but also means the attack can be performed by a low-privileged legitimate user (e.g., a tenant, guest, or restricted operator) seeking to escalate privileges or extract sensitive data. The impact is therefore not limited to perimeter attackers; insider and account-compromise scenarios are equally viable.

Notably, the affected and fixed version boundaries are partially inferable. The NVD description states the issue was "discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2," which implies the defect was remediated at or before version 4.42.2. However, the Patch Confidence score is 0/4, meaning no tracked source (vendor advisory, commit, changelog, or security bulletin) provides verifiable patch evidence. No CWE identifier, CVSS vector, or CVSS subscores have been published by NVD for this CVE, which limits quantitative risk scoring.

No public proof-of-concept, Nuclei template, or exploit code has been identified in the tracked sources. The EPSS score is 0.00321 (24.9th percentile), indicating a statistically low current exploitation probability in the wild, though EPSS does not measure future risk. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (SQL Injection) and the minimal technical details disclosed in the NVD description.

1. Reconnaissance / target identification. The attacker identifies a Selesta VAM deployment, e.g., via Shodan or Google dorks for VAM login pages or /common/ajaxfunction.php. Because the vulnerability requires authentication, the attacker must first obtain valid credentials — through credential stuffing, phishing, default credential attempts, or by being a legitimate low-privilege user of the system.

2. Flaw triggering. The attacker authenticates to the VAM web interface and crafts a malicious GET request to /common/ajaxfunction.php, inserting SQL metacharacters and payload fragments into the vulnerable GET parameter. The application passes this value into a SQL query without sanitization or parameterized binding. Given no parameter name is disclosed, the attacker would probe common parameter names or fuzz the endpoint to determine which parameter is injectable.

3. Payload / execution at the class level. At the SQLi class level, the attacker can employ:

   • UNION-based injection to append a second SELECT and retrieve arbitrary columns from other tables.
   • Boolean-based blind injection using conditions such as ' AND '1'='1 versus ' AND '1'='2 to infer data character-by-character.
   • Time-based blind injection using database-specific delay functions to confirm execution when responses show no other observable difference.
   • Stacked queries (if supported by the backend database) to execute additional statements such as UPDATE, INSERT, DELETE, or in some configurations, stored-procedure calls that can read or write files on the database host. The exact database backend (MySQL, MSSQL, PostgreSQL, etc.) is not specified in the NVD description, so the attacker's payload choices would be adapted to the detected backend.

4. Post-exploitation impact. Successful injection yields the privileges of the database account used by the VAM application. Realistic outcomes include: extraction of user credentials and password hashes from the VAM user table; disclosure of access-management records, tenant data, or audit logs; modification or deletion of access rules, effectively bypassing physical or logical access-control decisions enforced by VAM; and, if the database service account is overly privileged, operating-system-level compromise via file write/read or extended stored procedures. The authenticated precondition means the attacker already has a foothold; this vulnerability converts a low-privilege position into a database-level compromise.

Impact Assessment

Business impact. Selesta VAM is an access management platform; a SQL Injection vulnerability in such a product directly threatens the confidentiality, integrity, and availability of both the application and the facilities or logical resources it governs. Data confidentiality is the primary concern: an attacker can dump the entire database, including user credentials and access-control configuration. Integrity is at risk because injected UPDATE/DELETE statements can alter permissions, audit trails, or user records. Availability may be degraded through heavy or intentionally expensive queries that consume database resources, or through destructive statements.

Affected systems. All Selesta VAM installations running versions prior to 4.42.2. Because the CVE data lists no explicit affected version range beyond "prior to 4.42.2," organizations should verify their deployed VAM version and treat any version older than 4.42.2 as potentially vulnerable.

Blast radius. The application's database is the immediate blast radius. Downstream impact extends to any external system whose access decisions depend on VAM data — if an attacker tampers with access rules, physical or logical entry control decisions can be reversed, which is particularly serious if VAM is integrated with building security, visitor management, or privileged-access workflows. The authenticated precondition narrows the exposed population to users who already have accounts, reducing the external attack surface but amplifying insider-threat severity.

CVSS context. The official CVSS score and vector are N/A, with no subscores published. Consequently, quantitative severity cannot be cited from authoritative data. Organizations should perform an internal risk assessment, weighting the high confidentiality impact of a database dump against the moderate barrier of required authentication.

Detection Guidance

The following detection content targets the observable artifacts of this vulnerability: HTTP GET requests to /common/ajaxfunction.php containing SQL metacharacters, SQL keywords, or encoded payload variants in the query string. Because no specific parameter name is known, the rules combine endpoint matching with generic SQLi pattern detection. Tune these rules to the local logging environment and expected baseline traffic to reduce false positives.

Sigma Rule

title: Selesta VAM ajaxfunction.php SQL Injection Attempt
id: 3b81adf9-4a44-4f7a-9a2c-1f6b0c9d2e31
status: experimental
description: Detects GET requests to /common/ajaxfunction.php containing SQL injection patterns, potentially exploiting CVE-2023-42236 in Selesta Visual Access Manager.
author: Threat Intelligence Team
date: 2025/05/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-42236
logsource:
    category: webserver
    product: apache
    definition: Web server access logs covering the Selesta VAM application
detection:
    selection_endpoint:
        cs-method: GET
        cs-uri-path|contains: /common/ajaxfunction.php
    selection_sqli_patterns:
        cs-uri-query|contains:
            - "'"
            - '%27'
            - "UNION SELECT"
            - "UNION+SELECT"
            - "union%20select"
            - "information_schema"
            - "sleep("
            - "SLEEP%28"
            - "waitfor delay"
            - "WAITFOR+DELAY"
            - "1=1"
            - "1%3D1"
            - "OR 1=1"
    condition: selection_endpoint and selection_sqli_patterns
falsepositives:
    - Legitimate queries containing apostrophes or the word "union" in rare edge cases
    - Application health checks that send static query strings
level: high
tags:
    - attack.t1190
    - cve.2023-42236
    - cwe.89

YARA Rule

rule CVE_2023_42236_Selesta_VAM_SQLi {
    meta:
        author = "Threat Intelligence Team"
        description = "Detects SQL injection payloads in HTTP requests or logs related to Selesta Visual Access Manager /common/ajaxfunction.php"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-42236"
        cve = "CVE-2023-42236"
        date = "2025-05-10"
    strings:
        $endpoint = "/common/ajaxfunction.php" ascii nocase
        $sqli1 = "union select" ascii nocase
        $sqli2 = "union+select" ascii nocase
        $sqli3 = "union%20select" ascii nocase
        $sqli4 = "information_schema" ascii nocase
        $sqli5 = "sleep(" ascii nocase
        $sqli6 = "waitfor delay" ascii nocase
        $sqli7 = "waitfor+delay" ascii nocase
        $sqli8 = "1=1" ascii
        $sqli9 = "' or '1'='1" ascii nocase
        $sqli10 = "select%20" ascii nocase
    condition:
        uint16(0) == 0x0A0D or contains(any of them, "GET") and
        $endpoint and 2 of ($sqli*)
}

Note: the YARA rule is intended to scan web server access logs, proxy logs, or captured HTTP traffic. The uint16(0) == 0x0A0D and contains(any of them, "GET") conditions are heuristic anchors for log-file formats; adjust to the actual log structure in your environment.

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Selesta VAM /common/ajaxfunction.php SQL Injection Attempt (CVE-2023-42236)"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/common/ajaxfunction.php"; http.uri; pcre:"/[\?&][^&\s]*(%27|'|UNION\+?SELECT|union%20select|information_schema|SLEEP%?\(|WAITFOR\+?DELAY|1=1|OR%20\d+=\d+)/i"; classtype:web-application-attack; reference:cve,2023-42236; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2023-42236; sid:202342236; rev:1;)

Additional tuning variant for encoded payloads:

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Selesta VAM ajaxfunction.php Encoded SQLi Payload"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/common/ajaxfunction.php"; http.uri; content:"%27"; http.uri; pcre:"/(union|select|sleep|waitfor|schema)/i"; classtype:web-application-attack; reference:cve,2023-42236; sid:202342237; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and http.request.method == "GET"
    and url.path == "/common/ajaxfunction.php"
    and (
      url.query contains "UNION" or url.query contains "SELECT"
      or url.query contains "sleep(" or url.query contains "SLEEP("
      or url.query contains "waitfor" or url.query contains "WAITFOR"
      or url.query contains "information_schema"
      or url.query contains "1=1" or url.query contains "1%3D1"
      or url.query contains "'"
    )
  ]

For environments where URL query strings are stored as url.full:

any where network.protocol == "http" and http.request.method == "GET"
  and startsWith(url.full, "/common/ajaxfunction.php")
  and (url.full contains "%27" or url.full contains "union" or url.full contains "UNION"
       or url.full contains "sleep(" or url.full contains "waitfor"
       or url.full contains "information_schema" or url.full contains "1=1")

Splunk SPL Query

index=web OR index=proxy OR index=main sourcetype=access_combined
| where like(uri_path, "%/common/ajaxfunction.php%")
| eval decoded_query=urldecode(uri_query)
| where match(decoded_query, "(?i)(union\s+select|information_schema|sleep\s*\(|waitfor\s+delay|'\s*(or|and)\s*'\s*[0-9]|1\s*=\s*1)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, uri_query, status
| sort - count
| table first_seen, last_seen, src_ip, uri_path, uri_query, status, count

If using an HTTP proxy index with unencoded fields, adjust the field names accordingly (cs_uri_query, cs_uri_path, cs_method):

index=proxy sourcetype=pan:traffic
| where cs_method="GET" AND like(cs_uri_path, "%/common/ajaxfunction.php%")
| where match(cs_uri_query, "(?i)(union|select|sleep|waitfor|information_schema|%27|1%3D1)")
| stats values(cs_uri_query) as payloads, count by src, dst, cs_uri_path

Wazuh OSSEC Rule

<group name="web,sql_injection,cve_2023_42236,">
  <rule id="100422" level="12">
    <decoded_as>web</decoded_as>
    <match>ajaxfunction.php</match>
    <regex>UNION SELECT|UNION\+SELECT|union%20select|SLEEP\(|WAITFOR DELAY|WAITFOR\+DELAY|information_schema|1=1|1%3D1|%27</regex>
    <description>Selesta VAM /common/ajaxfunction.php SQL injection attempt (CVE-2023-42236)</description>
    <group>web_application_attack,sql_injection,cve_2023_42236,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100423" level="6">
    <if_sid>100422</if_sid>
    <regex>status=200</regex>
    <description>Possible successful SQLi response on Selesta VAM ajaxfunction.php (CVE-2023-42236)</description>
    <group>web_application_attack,sql_injection,cve_2023_42236,</group>
  </rule>
</group>

Ensure the Wazuh web decoder is enabled, and the VAM web server access logs are being ingested in real time. The companion rule 100423 escalates when the request returned HTTP 200, which may indicate the injection succeeded rather than being blocked.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No tracked source provides verifiable patch evidence. The NVD description implies that version 4.42.2 resolves the issue, but no official Selesta advisory, changelog entry, or patch artifact has been confirmed. Treat this CVE as unpatched until the vendor publishes an advisory.

1. Immediate mitigations (in order of priority):

   • Deploy or update a Web Application Firewall (WAF) with a rule that inspects all GET requests to /common/ajaxfunction.php and blocks query strings containing SQL metacharacters, SQL keywords, or encoded variants (', %27, UNION, SELECT, SLEEP(, WAITFOR, information_schema, 1=1).
   • Restrict network access to the VAM web interface: place it behind a VPN or allowlist so only authorized administrative networks can reach /common/ajaxfunction.php.
   • Review all accounts with access to VAM; disable inactive accounts and enforce strong, unique credentials and multi-factor authentication to reduce the likelihood of an authenticated attacker obtaining a foothold.
   • Apply the principle of least privilege to the database service account used by VAM: revoke xp_cmdshell, file-access privileges, and cross-database permissions where possible.
   • Enable or increase database-level auditing to capture anomalous SQL statements originating from the VAM application user.

2. Patch / upgrade steps:

   • Contact Selesta support to confirm the patched status of version 4.42.2 and request the official upgrade package or advisory.
   • If version 4.42.2 is available, upgrade all VAM servers to it or later in a maintenance window, following the vendor's backup and rollback procedures.
   • If the vendor does not respond or the fixed build is not available, formally document the residual risk and continue compensating controls indefinitely.

3. Long-term hardening:

   • Demand that the vendor remediate the issue with parameterized queries / prepared statements rather than input blacklisting; include this requirement in the contract or procurement SLA.
   • Integrate the Sigma, YARA, Suricata, Elastic, Splunk, and Wazuh rules above into your SIEM, IDS, and EDR pipelines to detect future exploitation attempts.
   • Perform a penetration test against the VAM application post-upgrade, specifically targeting /common/ajaxfunction.php, to confirm the injection is no longer reachable.
   • Monitor vendor security bulletins and the CVE record (NVD/CVE.org) periodically, as CVSS scoring, CWE assignment, and patch information may be published after this report was generated.

References

• NVD Entry — CVE-2023-42236: https://nvd.nist.gov/vuln/detail/CVE-2023-42236
• CVE.org Record — CVE-2023-42236: https://cve.org/CVERecord?id=CVE-2023-42236
• MITRE CWE-89 (SQL Injection): https://cwe.mitre.org/data/definitions/89.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2023-42236 NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS — CVE-2023-42236 (EPSS score 0.00321): https://www.first.org/epss/

Threat actor / in-the-wild status: No known threat actor campaigns or exploit-in-the-wild evidence have been identified in the tracked sources. The CVE is not listed in CISA KEV, no Nuclei template exists, and no public exploit code has been observed. The absence of in-the-wild evidence should not be treated as confirmation of safety given the unpatched patch status and the sensitivity of the affected product class.