CVE-2023-42238

Executive Summary

CVE-2023-42238 is a SQL injection vulnerability in Selesta Visual Access Manager (VAM), a physical/logical access management web application. An authenticated attacker can exploit unsanitized POST parameters in the /vam/vam_eps.php endpoint to execute arbitrary SQL statements against the underlying database. The vulnerability affects all VAM versions prior to 4.42.2, and entities deploying VAM in production should treat the application as compromised-capable until the flaw is remediated. No CVSS score, CWE identifier, or working exploit has been published by NVD, and no patch evidence is currently tracked.

Technical Analysis

The NVD description states that the flaw resides in Selesta Visual Access Manager (VAM) prior to version 4.42.2, specifically in the vam_eps.php script. The vulnerability class is SQL injection, and the injection surface consists of multiple POST parameters submitted to this endpoint. Because the attacker must be authenticated, the injection occurs after the application's existing authentication layer has been passed, meaning the vulnerable parameters are those consumed by post-login business logic (for example, event processing, badge validation, or report filtering within the access-management workflow).

From a mechanism standpoint, SQL injection arises when data supplied by the client is embedded into a dynamic SQL query without parameterized binding or sufficient escaping. In this case, the attacker-controlled POST body is processed by vam_eps.php and concatenated into one or more SQL statements. The absence of detailed vendor documentation means the exact query structure, database backend, and parameter names are not disclosed in the advisory. However, the classic exploitation primitive applies: an attacker can terminate the original query and append additional SQL fragments, enabling data exfiltration, authentication bypass within the application's database context, privilege escalation, or — in some configurations — operating-system command execution via extended stored procedures or file-write primitives.

The attack surface is the HTTP front-end of the VAM web server, reachable over the network. Authentication is required, which lowers the exposure from unauthenticated internet scanning but does not meaningfully reduce risk because VAM user accounts are often provisioned broadly (operators, guards, administrators). The endpoint /vam/vam_eps.php is the only code-level detail confirmed by the description; all other implementation specifics should be treated as unknown until the vendor releases additional guidance.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code has been identified for CVE-2023-42238 as of this report. The attack chain below is therefore inferred from the confirmed vulnerability class and the disclosed endpoint.

1. Reconnaissance / Target Identification — An attacker with valid credentials (or an insider) locates the VAM login page, then enumerates application routes. The presence of /vam/vam_eps.php in HTTP responses, favicon identifiers, or response headers identifies the vulnerable software version. Anonymous scans may fingerprint VAM via title strings such as "Visual Access Manager" or via predictable asset paths under /vam/.

2. Authentication and Endpoint Access — The attacker authenticates with a legitimate low-privilege account. Once the session cookie is obtained, requests to /vam/vam_eps.php are accepted by the application. The attacker then enumerates the POST parameters accepted by the endpoint — via parameter fuzzing, review of client-side JavaScript, or inspection of legitimate requests generated through the VAM user interface.

3. Payload Execution — The attacker submits crafted values in one or more POST parameters of /vam/vam_eps.php. Typical SQL injection payloads at the class level include:

   • ' OR '1'='1 to alter WHERE-clause logic and bypass record-level filters;
   • ' UNION SELECT ... to aggregate sensitive data into the application response;
   • '; WAITFOR DELAY '0:0:5'-- or SLEEP(5) for time-based blind confirmation;
   • ' AND (SELECT ... FROM information_schema.tables)-- to enumerate schema. Because the endpoint's response may or may not reflect query output, error-based, union-based, or blind techniques would be selected based on the database engine behavior. The exact parameter names are not disclosed in the NVD description and should not be assumed.

4. Post-Exploitation Impact — Successful exploitation grants the attacker database-level access equivalent to the account used by the VAM application. This can include reading stored credentials, badge/access-control records, personnel data, audit logs, and configuration secrets. Depending on database privileges, the attacker may write files to the web root (enabling webshell deployment) or invoke extended functionality (e.g., xp_cmdshell on Microsoft SQL Server) to escalate to operating-system access. The confidentiality and integrity impact is thus high for the VAM deployment and any connected identity stores.

Impact Assessment

The business impact of CVE-2023-42238 is significant for organizations relying on VAM for physical access control, visitor management, and security-zone enforcement. A successful SQL injection can expose privileged operational data — employee schedules, access-card identifiers, facility maps, and configuration of alarm or lockdown procedures — which materially aids physical intrusion or insider threats. Integrity impact extends to the potential modification of access-control records: an attacker could grant credentials, alter clearance levels, or disable revocation entries.

The blast radius is broadened by the fact that VAM often aggregates identity data from multiple sources (HR systems, active directory, visitor registries). Database compromise therefore becomes an indirect pivot to enterprise identity infrastructure.

CVSS scoring is not available (N/A) because neither NVD nor the CNA has assigned a vector; analysts should treat this as an un-scored but credible high-severity risk based on the vulnerability class. The EPSS score of 0.00321 (24.9th percentile) indicates a low current probability of exploitation in the wild, which is consistent with the absence of public exploit code. However, EPSS is a predictive measure and does not reflect the severity of impact for a given organization; the lack of a patch raises the latent risk considerably.

Detection Guidance

The following detection content assumes visibility into HTTP traffic and web-server access logs. Because the exact injectable parameter names are not disclosed, the rules focus on anomalous POST requests to /vam/vam_eps.php containing SQL metacharacters and SQL keywords, plus out-of-band indicators such as database error strings or timing anomalies.

Sigma Rule

title: Selesta VAM vam_eps.php SQL Injection Attempt
id: 4f6a3c1d-9b21-4a8e-8d3f-6a2e7c9d0b44
status: experimental
description: Detects POST requests to /vam/vam_eps.php containing SQL injection patterns (CVE-2023-42238).
author: Valter Security Research
date: 2025/01/01
logsource:
  category: webserver
  product: apache
  definition: 'Requires web server access logs with POST body or a WAF/reverse proxy that logs request bodies. If bodies are unavailable, restrict detection to URI and response-code anomalies.'
detection:
  selection:
    cs-method: 'POST'
    c-uri|contains: '/vam/vam_eps.php'
  filter_known_good:
    cs-uri-query|contains:
      - 'submit=1'
      - 'action=view'
  keywords|contains:
    - "' OR "
    - "UNION SELECT"
    - "information_schema"
    - "sleep("
    - "WAITFOR DELAY"
    - "/*"
    - "0x"
    - "concat("
  condition: selection and not filter_known_good and keywords
falsepositives:
  - Legitimate security scanning tools
  - Administrative debugging with raw SQL input
level: high
tags:
  - attack.t1190
  - cve.2023-42238
  - cwe.89

YARA Rule

rule CVE_2023_42238_Selesta_VAM_SQLi_PostBody
{
    meta:
        author = "Valter Security Research"
        description = "Detects SQL injection payloads in HTTP POST bodies targeting Selesta VAM vam_eps.php endpoint"
        cve = "CVE-2023-42238"
        date = "2025-01-01"
        severity = "high"
    strings:
        $endpoint = "vam_eps.php" ascii wide nocase
        $s1 = "union select" ascii wide nocase
        $s2 = "information_schema" ascii wide nocase
        $s3 = "waitfor delay" ascii wide nocase
        $s4 = "sleep(" ascii wide nocase
        $s5 = "' or " ascii wide nocase
        $s6 = "concat(" ascii wide nocase
        $s7 = "version()" ascii wide nocase
        $s8 = "select load_file" ascii wide nocase
    condition:
        uint16(0) == 0x0D0A or $endpoint
        and 2 of ($s*)
}

Suricata IDS Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2023-42238 Selesta VAM vam_eps.php SQL Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/vam/vam_eps.php"; http.http_body; pcre:"/(union\s+select|information_schema|sleep\s*\(|waitfor\s+delay|'\\s*or\\s+'|concat\s*\()/i"; classtype:web-application-attack; reference:cve,2023-42238; sid:10142238; rev:1;)

Elastic Detection

any where network.protocol == "http"
  and http.request.method == "POST"
  and startsWith(http.request.uri, "/vam/vam_eps.php")
  and (
    wildcard(http.request.body, "*union*select*", "*information_schema*", "*waitfor*delay*", "*sleep(*")
    or strings.contains(http.request.body, "' or '", "concat(", "0x")
  )

Note: enable request-body capture in your HTTP instrumentation (e.g., Packetbeat with include_body, or a WAF log index) for this rule to be effective.

Splunk SPL Query

index=web OR index=proxy OR index=ids
  http_method=POST AND uri="/vam/vam_eps.php"
  | regex form_data="(?i)(union\s+select|information_schema|sleep\s*\(|waitfor\s+delay|'\s*or\s*'|concat\s*\()"
  | stats count min(_time) max(_time) by src_ip, uri, form_data
  | where count >= 3
  | sort - count

Wazuh OSSEC Rule

<group name="web,sql_injection,">
  <rule id="568599" level="12">
    <if_sid>31100</if_sid>
    <url>/vam/vam_eps.php</url>
    <method>POST</method>
    <regex>(?i)(union\s+select|information_schema|sleep\s*\(|waitfor\s+delay|'\s*or\s*')</regex>
    <description>CVE-2023-42238: Possible SQL injection in Selesta VAM vam_eps.php</description>
    <group>attack.t1190,cwe.89,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for this advisory is 0/4 — no patch evidence from any tracked source has been observed. The NVD description indicates the flaw exists "prior to 4.42.2," implying version 4.42.2 is the fixed release, but no official advisory, changelog entry, or download artifact has been verified.

1. Immediate Mitigations

   • Restrict access to /vam/vam_eps.php at the network layer: allow only trusted administrative networks and defined operator subnets via firewall or reverse-proxy ACLs.
   • Place a Web Application Firewall (WAF) ahead of VAM with blocking rules for SQL injection (%27, UNION, SLEEP, WAITFOR, stacked queries) and require positive-allowlist validation for all POST parameters if the WAF supports a learning mode.
   • Audit all existing VAM user accounts; disable dormant accounts, enforce strong authentication, and remove shared credentials to reduce the authenticated-attacker surface.
   • Monitor database audit logs for anomalous queries originating from the VAM application service account (e.g., unexpected SELECT, UNION, or metadata queries against information_schema).

2. Patch / Upgrade Steps

   • Contact Selesta support directly to request the 4.42.2 release and confirm whether it addresses CVE-2023-42238; the vendor advisory channel is currently unverified.
   • If version 4.42.2 is obtained, back up the VAM configuration and database, review release notes, schedule a maintenance window, and deploy in a staging environment first.
   • After upgrade, re-run the detection rules above against staging traffic to confirm the injectable parameters are no longer processed.

3. Long-Term Hardening

   • Enforce a vendor-driven policy: all database access from the VAM application must use parameterized queries or stored procedures; require Selesta to publish a security changelog.
   • Segment VAM, its database backend, and any physical-access controllers into a dedicated management VLAN with egress restrictions.
   • Rotate the VAM application database credentials after remediation, because the SQL injection primitive may have exposed the credential in DBA or application tables.
   • Establish an asset-inventory review cycle for industrial/IoT adjacent web applications that are often missing from patch-management programs.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-42238
• MITRE CVE Record: https://www.cve.org/CVERecord?id=CVE-2023-42238
• CISA KEV Catalog: Not applicable — this CVE is not listed (CISA KEV: NO)
• FIRST EPSS Score Lookup: https://www.first.org/epss/search (CVE-2023-42238, EPSS 0.00321)

No vendor advisory, researcher blog, or known threat-actor campaign referencing CVE-2023-42238 was identified in the tracked data sources at the time of writing. No evidence of exploitation in the wild is currently available.