CVE-2023-42237

Executive Summary

CVE-2023-42237 is an authenticated SQL Injection vulnerability in Selesta Visual Access Manager (VAM), a physical/visual access management web application. The flaw affects all deployments prior to version 4.42.2 and is triggered through multiple GET parameters of the web endpoint /vam/vam_i_command.php. An authenticated attacker can exploit this issue to read, modify, or delete database records managed by the VAM platform, including access-control and user-credential data, which can lead to full compromise of the access-management trust model. No public exploit code, CISA KEV listing, or CVSS scoring has been published, and patch confidence from tracked sources is 0/4, meaning the asset remains effectively unpatched until the vendor release is independently verified.

Technical Analysis

The NVD description identifies a single, unambiguous vulnerability class: SQL Injection in Selesta Visual Access Manager (VAM) prior to version 4.42.2. The flaw is reachable only by an authenticated attacker, which distinguishes it from typical unauthenticated pre-auth SQLi flaws and lowers the barrier assessment for external reconnaissance but does not eliminate risk — any valid account, including low-privilege operator accounts, can likely target the vulnerable parameters.

The affected surface is the HTTP GET endpoint /vam/vam_i_command.php. The description explicitly states that multiple GET parameters on this endpoint are susceptible to SQL injection. At the mechanism level, this indicates the application fetches one or more values from the HTTP query string and embeds them into SQL statements without sufficient validation, escaping, or parameterization. An attacker who can control these parameter values can therefore alter the final SQL query executed by the backend database.

Specific parameter names, the underlying DBMS (MySQL, PostgreSQL, MSSQL, Oracle, etc.), and the exact query structure are not disclosed in the NVD description. Consequently, this report describes the vulnerability at the class level: classic in-band (UNION-based) or inferential (boolean-blind/time-based) injection over HTTP GET.

Key technical characteristics:

• Precondition: Valid application-level authentication. The vulnerability does not require administrative privileges; any authenticated role is a candidate.
• Attack vector: HTTP GET request to /vam/vam_i_command.php with malicious content in one or more query-string parameters.
• Impact channel: The injected SQL executes with the privileges of the database account used by the VAM application. If that account has broad privileges (e.g., SELECT, INSERT, UPDATE, DELETE, DROP), the attacker inherits them.
• Secondary risk: With stacked queries (if supported by the DBMS and driver), the attacker may be able to call stored procedures, write files, or — on some platforms — execute operating-system commands.

The absence of an assigned CWE, CVSS vector, and CNA title in the source data indicates incomplete enrichment by NVD/CNA at the time of writing. This is a reporting gap and should not be interpreted as reduced severity. The EPSS score of 0.00241 (15.6th percentile) suggests a low current probability of exploitation in the wild, typical for niche enterprise physical-security appliances that are less frequently scanned than mainstream web software. The lack of a CISA KEV entry corroborates that no known-exploited status has been cataloged.

Because no patch has been confirmed by any tracked source, the product should be treated as vulnerable in all deployments until 4.42.2 (or later) is verified installed and confirmed by the vendor as containing the fix implied by the NVD version note.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists for CVE-2023-42237 in the provided data. The attack chain below is therefore inferred from the NVD description and the SQL injection vulnerability class. All endpoint and parameter references are limited to information explicitly present in the description; no additional implementation details are fabricated.

1. Reconnaissance / target identification.
An attacker first identifies VAM instances. VAM is a web application typically deployed for managing visual access systems; it is often reachable via its web login portal on an enterprise network segment, and sometimes exposed to the internet. Search engines such as Shodan can be used with queries targeting the application title or HTML fingerprints (e.g., http.title:"Visual Access Manager"). The attacker then obtains valid credentials. Because the vulnerability is authenticated, the attacker must either (a) possess legitimate operator credentials, (b) obtain credentials via phishing, credential stuffing, or default-credential guessing, or (c) combine this flaw with a separate authentication-bypass issue.

2. Triggering the flaw.
With valid session cookies or HTTP basic credentials, the attacker crafts a GET request to /vam/vam_i_command.php and places a SQL injection probe in one or more of the endpoint's GET parameters. Typical initial probes are logical tautologies (e.g., a numeric parameter with OR 1=1), malformed quote characters to induce a database error, or a trailing comment delimiter (--, #, /*) to truncate the remainder of the original query.

3. Payload / execution method.
At the vulnerability-class level, the attacker uses standard SQLi extraction techniques:

• Error-based: injecting expressions that cause the DBMS to echo data inside error messages.
• UNION-based: aligning injected UNION SELECT columns with the original query to retrieve arbitrary rows from other tables.
• Boolean-blind / time-based: using conditional expressions (IF, CASE) and delay functions (SLEEP(), BENCHMARK()) or heavy queries to leak data one character at a time when no error or inline data is returned.

All payloads are transmitted as GET query-string values, making them observable in web-server access logs and HTTP proxy logs.

4. Post-exploitation impact.
Successful injection yields the attacker the same data-access privileges as the database account bound to the VAM application. Likely targets within the database are user tables (application login credentials, password hashes), access-rights/visitor records, badge or credential identifiers, door/zone configuration, and audit trails. The attacker could:

• Extract credential hashes and attempt offline cracking or pivoting to other systems using reused passwords.
• Modify access-control records to grant persistent physical access rights.
• Tamper with audit/event logs to cover traceability.
• If the database account permits write access to OS-level features (e.g., INTO OUTFILE on MySQL, xp_cmdshell on MSSQL), escalate to operating-system command execution and, subsequently, full internal network compromise.

The trust model of a physical access management system makes this especially sensitive: the database is the authoritative source for who is allowed into facilities, and corruption of that source yields persistent, hard-to-detect physical-security impact.

Impact Assessment

CVE-2023-42237 affects all Selesta VAM installations prior to version 4.42.2. The vulnerable component, /vam/vam_i_command.php, is internet-facing in many deployments since VAM is a web administration console; in all cases, it is reachable by any authenticated network user.

Business impact. VAM manages visual access and physical entry decisions. Exploitation directly undermines:

• Confidentiality: leakage of user credentials, visitor records, facility layout metadata, and access patterns.
• Integrity: unauthorized modification of access lists, badge states, and audit logs; an attacker can grant persistent physical access to unauthorized personnel.
• Availability: database-level damage (deleted tables, corrupted rows) can take the access-control system offline, impacting physical security operations and compliance reporting.

Blast radius. Because the application's database account may have elevated rights spanning multiple tables and possibly multiple integrated systems (e.g., LDAP, HR systems), a single injection point can metastasize into lateral movement across the corporate network. Physical access systems frequently reside on sensitive OT/security segments, increasing the real-world consequences of a compromise.

Severity context. No CVSS vector is available, which hinders automated risk scoring in vulnerability-management platforms. As a compensating measure, organizations should treat the issue using conservative heuristics: an authenticated SQLi in a physical-security product typically scores High (7.0–8.8) under CVSSv3.1 when considering confidentiality, integrity, and partial availability impact. The EPSS score of 0.00241 indicates low immediate threat-actor interest, but this can change rapidly if exploit code is published. The product currently has no confirmed patch in tracked sources, which elevates residual risk substantially — an unpatched high-severity web vulnerability on a networked appliance is a standing exposure.

Detection Guidance

The following detection content targets exploitation of CVE-2023-42237. Detection focuses on (1) HTTP requests to /vam/vam_i_command.php containing SQL metacharacters or known SQLi keywords, and (2) abnormal request patterns from authenticated sessions. The rules are generic to the SQLi class and will also surface legitimate security-scanner traffic; false positives should be tuned to the environment.

Sigma Rule

title: Selesta VAM vam_i_command.php SQL Injection Attempt (CVE-2023-42237)
id: 9c6e4f2a-7d3b-4c8e-9f1a-2b5d6e7f8a01
status: experimental
description: Detects SQL injection payloads in GET requests to /vam/vam_i_command.php, the endpoint affected by CVE-2023-42237.
author: Threat Intelligence Team
date: 2025-05-27
modified: 2025-05-27
logsource:
  category: webserver
  product: apache
  service: access_log
detection:
  selection_path:
    cs-uri-path|startswith: '/vam/vam_i_command.php'
  selection_payload:
    cs-uri-query|contains|all:
      - "'"
    cs-uri-query|contains:
      - 'union select'
      - 'union all'
      - 'information_schema'
      - 'sleep('
      - 'benchmark('
      - 'extractvalue('
      - 'updatexml('
      - '1=1'
      - '1=2'
      - 'or 1=1'
      - '--'
      - '#'
      - '/*'
      - 'concat('
      - '0x'
  condition: selection_path and selection_payload
falsepositives:
  - Legitimate queries with apostrophes in URL-encoded text
  - Web vulnerability scanners and CPE checks
level: high
tags:
  - attack.t1190
  - cve.2023-42237

YARA Rule

rule selesta_vam_sqli_cve_2023_42237 {
    meta:
        author = "Threat Intelligence Team"
        description = "Detects SQL injection payloads targeting /vam/vam_i_command.php (CVE-2023-42237)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-42237"
        cve = "CVE-2023-42237"
        date = "2025-05-27"
        severity = "high"
    strings:
        $endpoint = "/vam/vam_i_command.php" ascii nocase
        $sqli_union_sel = "union select" ascii nocase
        $sqli_union_all = "union all" ascii nocase
        $sqli_schema = "information_schema" ascii nocase
        $sqli_sleep = "sleep(" ascii nocase
        $sqli_bench = "benchmark(" ascii nocase
        $sqli_extract = "extractvalue(" ascii nocase
        $sqli_updatexml = "updatexml(" ascii nocase
        $sqli_or_true = "or 1=1" ascii nocase
        $sqli_comment = "--" ascii
        $sqli_quote = "'" ascii
        $sqli_hex = "0x" ascii
    condition:
        $endpoint and
        (
            (3 of ($sqli_*)) or
            ($sqli_quote and 2 of ($sqli_union_sel, $sqli_union_all, $sqli_schema, $sqli_or_true, $sqli_comment))
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"SELESTA VAM vam_i_command.php SQL Injection Attempt (CVE-2023-42237)";
    flow:established,to_server;
    http.uri;
    content:"/vam/vam_i_command.php"; nocase;
    pcre:"/(union[\+\s]+select|union[\+\s]+all|information_schema|extractvalue\s*\(|updatexml\s*\(|sleep\s*\(|benchmark\s*\(|(^|&)[^&]*\x27|1=1|--\s*(&|$))/i";
    classtype:web-application-attack;
    reference:cve,2023-42237;
    sid:202342237;
    rev:1;
    metadata:created_at 2025_05_27;
)

Elastic Detection

any where
  (event.category == "web" or network.protocol == "http") and
  url.path == "/vam/vam_i_command.php" and
  (
    wildcard(url.query, "*union*select*", "*union*all*", "*information_schema*",
             "*extractvalue(*", "*updatexml(*", "*sleep(*", "*benchmark(*", 
             "*1=1*", "*or+1=1*", "*%27*")
  )

Splunk SPL Query

index=web* sourcetype=access_combined
  uri_path="/vam/vam_i_command.php"
  (uri_query="*union*select*" OR uri_query="*union*all*" OR
   uri_query="*information_schema*" OR uri_query="*extractvalue*" OR
   uri_query="*updatexml*" OR uri_query="*sleep(*" OR
   uri_query="*benchmark(*" OR uri_query="*1=1*" OR
   uri_query="*%27*" OR uri_query="*--*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri_query) as queries by src_ip, user, uri_path
| where count >= 3
| sort - count

Wazuh OSSEC Rule

<group name="web,sql_injection,cve_2023_42237,">
  <rule id="100237" level="10">
    <decoded_as>web-access</decoded_as>
    <field name="url">/vam/vam_i_command.php</field>
    <regex>union\s+select|union\s+all|information_schema|sleep\s*\(|benchmark\s*\(|extractvalue\s*\(|updatexml\s*\(|or\s+1=1|1=1--</regex>
    <description>Selesta VAM (CVE-2023-42237) SQL injection attempt detected in /vam/vam_i_command.php</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_application_attack,sql_injection,attack_2001,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch status: 0/4 — UNPATCHED. No patch artifact, vendor advisory, or fix commit was identified in any tracked source at the time of writing. The NVD description states the issue affects VAM "prior to 4.42.2," which implies version 4.42.2 contains the remediation; however, this has not been independently confirmed. Treat the product as vulnerable until the vendor explicitly confirms the fix.

1. Immediate mitigations (defense in depth while unpatched):

• Apply virtual patching: deploy WAF (ModSecurity/CRS or commercial) rules that block union select, information_schema, sleep(, benchmark(, and single-quote injection patterns on the URI path /vam/vam_i_command.php.
• Restrict network exposure: place the VAM web console behind the corporate VPN or a bastion with strict source-IP allowlists; do not expose it directly to the internet.
• Enforce strong authentication: mandatory MFA for all VAM accounts; immediately rotate and disable default/legacy credentials.
• Apply least privilege at the database layer: ensure the account used by the VAM application has only the minimum grants (e.g., SELECT/INSERT/UPDATE on needed tables, no DROP, no FILE, no PROCESS, no stored-procedure execution).
• Monitor for the detection patterns above on web proxies, IDS/IPS, and access logs.

2. Patch / upgrade steps:

• Contact Selesta directly to confirm whether version 4.42.2 (or later) resolves CVE-2023-42237 and to obtain the official release package and advisory.
• If 4.42.2 is confirmed as the fixed version, schedule an upgrade during a maintenance window; VAM is a physical-access management system, so upgrades must be coordinated with facility-security operations and validate backward compatibility of access-control data.
• After upgrade, verify the fix by re-sending a benign SQLi test payload to /vam/vam_i_command.php in a test environment and confirming the request is rejected or parameterized.

3. Long-term hardening:

• Mandate that the vendor publishes CWE and CVSS data for this and future advisories to enable accurate risk scoring.
• Establish a formal product-security review process for VAM deployments: track vendor advisories, subscribe to the vendor's security mailing list, and re-assess exposure quarterly.
• Segment the VAM application, its database, and related physical-security services into a dedicated security/OT VLAN with egress filtering and no direct route to general corporate systems.
• Implement centralized logging (Wazuh/SIEM) of all VAM web traffic with the detection rules above and a defined alert/response runbook.
• Periodically review VAM user accounts and audit logs for anomalous access; revoke accounts of former staff promptly.
• If the application remains unpatched after a reasonable vendor-response period, consider compensating controls such as a reverse proxy that performs strict input validation, or isolating the console entirely from user networks.

References

At the time of writing, no vendor advisory, researcher blog, exploit-db entry, or threat-actor campaign referencing CVE-2023-42237 was identified in the provided data. There is no CISA KEV entry and no evidence of exploitation in the wild (EPSS 0.00241; 15.6th percentile; PoC/exploit status UNKNOWN). The following authoritative records were used.

1. NVD — CVE-2023-42237: https://nvd.nist.gov/vuln/detail/CVE-2023-42237
2. CVE.org Record — CVE-2023-42237: https://www.cve.org/CVERecord?id=CVE-2023-42237
3. FIRST EPSS (score 0.00241): https://www.first.org/epss/
4. CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Note on gaps: The source data lacks a CNA title, CVSS vector, CWE assignment, vendor advisory link, and explicit patch reference. Until the CNA or vendor enriches the record, security teams should treat the NVD description as the sole authoritative technical scope: authenticated SQL injection in multiple GET parameters of /vam/vam_i_command.php, affecting VAM prior to 4.42.2.