CVE-2023-42239

Executive Summary

CVE-2023-42239 is a SQL injection vulnerability in Selesta Visual Access Manager (VAM) versions prior to 4.42.2. An authenticated attacker can exploit multiple POST parameters of the /vam/vam_ep.php endpoint to inject arbitrary SQL commands into the back-end database. Successful exploitation could allow data exfiltration, modification of access–control records, and potential escalation to database or operating system compromise; the NVD has not assigned a CVSS score, and no in-the-wild exploitation has been publicly reported.

Technical Analysis

Selesta Visual Access Manager is a physical/logical access management platform widely deployed to manage users, badges, door locks, and authorization policies through a web interface. The vulnerability described in the NVD record resides in the web endpoint /vam/vam_ep.php. The application fails to adequately validate or parameterize data supplied by an authenticated user in multiple POST body parameters, allowing SQL injection.

The exact code path is not documented, and no vendor advisory with code-level details has been released. The flaw is therefore best understood at the vulnerability-class level:

• Unsafe SQL construction – The application likely concatenates raw user input from POST fields into SQL statements destined for the back-end database. Because several POST parameters are mentioned in the NVD description, the issue is not restricted to a single input field.
• Lack of parameterized queries – Instead of using prepared statements or stored procedures with bound parameters, the vulnerable endpoint appears to interpolate the input directly into query strings. This is the classic mechanism for all SQL injection variants, including boolean-based, union-based, time-based, and error-based.
• Authenticated prerequisite – The description explicitly states that the attacker must be authenticated. This narrows the attack surface to valid users of the VAM portal, but does not reduce the importance of the issue: an authenticated low-privileged user (e.g., a badge holder or help-desk operator) could leverage this flaw to obtain administrative control or extract the entire database.

The database backend is not identified, but common deployments of access management systems use MySQL, Microsoft SQL Server, or PostgreSQL. The impact varies accordingly:

• On MySQL: attackers may use UNION SELECT to dump data, LOAD_FILE() to read server files, or INTO OUTFILE to write a web shell if the application user has FILE privileges.
• On MSSQL: xp_cmdshell could be enabled and used for operating-system command execution if the service account has sufficient privileges.
• On PostgreSQL: pg_read_file() and COPY ... FROM PROGRAM can lead to file disclosure or code execution.

No CWE classification was provided in the data set, but the vulnerability class maps directly to CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). No CVSS vector exists in the NVD data, so severity scoring cannot be reported with confidence.

Exploitation Scenarios

Because no public PoC has been released, the following attack chain is inferred strictly from the NVD description and standard SQL injection techniques. It is intended to illustrate the possible paths an attacker would take against an exposed VAM deployment.

1. Reconnaissance / target identification
   Attackers locate Selesta VAM installations via Internet scanning (e.g., Shodan, Censys) using dorks that match the login page or auxiliary files referencing “vam”. They may search for vam_ep.php in HTTP response bodies or use title searches for “Visual Access Manager”. Once found, they enumerate the authentication portal and assess whether the deployed version is prior to 4.42.2.

2. Authentication
   The attack requires an authenticated session. The attacker can achieve this using:

   • Default credentials that might have been left unchanged from installation.
   • Phished credentials from an employee.
   • Reused credentials obtained from another breach.
   • A previously compromised low-privilege VAM account.

   After successful login, the attacker obtains the session cookie required for POST requests to /vam/vam_ep.php.

3. Triggering the SQL injection
   The attacker sends a crafted HTTP POST request to /vam/vam_ep.php. Because the NVD states “multiple POST parameters” are vulnerable, several fields in the request body can be used as injection carriers. Generic payload patterns include:

   • Boolean-based: ' OR '1'='1 or ' OR 1=1-- to bypass filters or alter a query’s result set.
   • Union-based: ' UNION SELECT username,password FROM users-- to retrieve arbitrary columns.
   • Time-based / blind: ' OR SLEEP(5)-- (MySQL) or ' OR WAITFOR DELAY '0:0:5'-- (MSSQL) to infer data one character at a time through response timing.

   These payload strings are illustrative of the SQLi class; the exact parameters and SQL syntax of the vulnerable VAM endpoint are not publicly known.

4. Post-exploitation impact
   Once injection succeeds, the attacker can:

   • Dump the entire VAM database, including usernames, password hashes, badge numbers, access schedules, audit trails, and personal identity data.
   • Update or insert new access-control records, granting unauthorized door access or disabling security policies.
   • Delete or tamper with audit logs to evade detection.
   • If the database account has elevated privileges, pivot to the underlying operating system (e.g., MSSQL xp_cmdshell, MySQL INTO OUTFILE) and achieve remote code execution.

The lack of a public PoC means the attack chain cannot be confirmed end-to-end; however, the vulnerability class provides a well-understood exploitation roadmap.

Impact Assessment

Selesta VAM is not a generic web application – it is a security enforcement point. The business impact of CVE-2023-42239 must be evaluated through both information security and physical security lenses:

• Confidentiality – The database contains sensitive identity data and access rights. An attacker who succeeds in SQL injection can exfiltrate credentials (including password hashes that may be crackable) and personal data of employees, including those in restricted facilities.
• Integrity – Access-control records (badges, door groups, approval statuses) can be altered. An attacker could enable their own badge for a secure data-center entrance or create a “ghost” identity with physical access privileges.
• Availability – Queries that delete critical tables or trigger heavy CPU time (e.g., BENCHMARK calls) could cause the application or database to become unavailable, disrupting physical security operations.
• Blast radius – If VAM is integrated with corporate Active Directory or LDAP, the database may mirror organizational identity data, magnifying the impact of a data leak. Additionally, the VAM server often sits on a privileged network segment with access to door controllers; a full server compromise could lead to lateral movement into industrial control networks, badge-reading systems, and building-management systems.

The absence of a CVSS score hampers quantitative ranking. Based on the principle of least privilege and the authenticated requirement, severity is likely high for confidentiality and integrity (estimated to be in the 6.5–8.8 range) but should not be treated as an official score. EPSS places this vulnerability at 0.00321 (24.9th percentile), indicating low exploit probability in the wild today. This is consistent with the lack of a public PoC and the niche deoployment of the product.

Detection Guidance

Detection rules below focus on the known URI path /vam/vam_ep.php and generic SQL injection signatures. Since parameter names are unknown, the rules look for SQL keywords and metacharacters inside request bodies directed at this endpoint. Tune rules according to your logging infrastructure and false-positive rates.

Sigma Rule

title: SQL Injection Attempt against Selesta VAM vam_ep.php
id: 8cbc78b1-1e2a-4f0a-9b3e-4f0b0d2a8e1c
status: experimental
description: Detects SQL injection patterns in POST requests to the Selesta VAM endpoint vam_ep.php, vulnerable to CVE-2023-42239.
author: Threat Intelligence @ valtersit.com
date: 2025/04/05
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2023-42239
logsource:
    category: webserver
    product: iis, apache, nginx
    definition: 'Web server access logs with full request URI and POST data captured.'
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/vam/vam_ep.php'
    keywords:
        - "'"
        - "OR 1=1"
        - "UNION SELECT"
        - "SLEEP("
        - "WAITFOR DELAY"
        - "0x"
        - ";--"
        - "/*"
    condition: selection and keywords
fields:
    - clientip
    - cs-uri-stem
    - cs-body
falsepositives:
    - Legitimate use of quoted strings in POST parameters (rare for VAM).
level: high

YARA Rule

rule Selesta_VAM_SQLi_CVE_2023_42239
{
    meta:
        author = "Threat Intelligence @ valtersit.com"
        description = "Detects HTTP POST bodies targeting /vam/vam_ep.php with common SQL injection patterns."
        cve = "CVE-2023-42239"
        date = "2025-04-05"
    strings:
        $uri = "vam_ep.php" ascii nocase
        $sqli1 = "OR 1=1" ascii nocase
        $sqli2 = "UNION SELECT" ascii nocase
        $sqli3 = "SLEEP(" ascii nocase
        $sqli4 = "WAITFOR DELAY" ascii nocase
        $sqli5 = "/*" ascii
        $sqli6 = "EXEC xp_cmdshell" ascii nocase
        $sqli7 = "information_schema" ascii nocase
    condition:
        $uri and any of ($sqli*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2023-42239 Selesta VAM vam_ep.php SQL Injection Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/vam/vam_ep.php"; http.client_body; content:"'"; pcre:"/(?i)(\s|^)(OR|UNION|SELECT|SLEEP|WAITFOR|BENCHMARK)(\s|$)/"; reference:cve,2023-42239; classtype:web-application-attack; sid:2024000322; rev:1;)

Elastic Detection

network where network.protocol == "http" and http.request.method == "POST" and url.path == "/vam/vam_ep.php" and (
  http.request.body.content like "*' OR *" or
  http.request.body.content like "*UNION SELECT*" or
  http.request.body.content like "*SLEEP(*" or
  http.request.body.content like "*WAITFOR DELAY*"
)

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=pan:traffic OR sourcetype=stream:http
| where lower(uri_path)="/vam/vam_ep.php" AND lower(http_method)="post"
| regex _raw "(?i)('|(\sor\s)|(\sunion\s+select)|sleep\(|waitfor(\s)+delay|or(\s)+1=1)"
| table _time, src_ip, dest_ip, uri, http_method, uri_query, req_body, status
| eval attack_type="SQLi_CVE-2023-42239"

Wazuh OSSEC Rule

<group name="web, access_control, sqli, cve,">
  <rule id="100422" level="10">
    <decoded>apache-accesslog</decoded>
    <match>POST /vam/vam_ep.php</match>
    <regex>(?i)('|\bor\b|\bunion\b|\bsleep\b|waitfor|benchmark)</regex>
    <description>CVE-2023-42239 - Selesta VAM SQL Injection attempt against /vam/vam_ep.php</description>
    <group>attack.web_attack,sqli,</group>
    <mitre><id>T1190</id><ref>https://attack.mitre.org/techniques/T1190/</ref></mitre>
    <cve>CVE-2023-42239</cve>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4, meaning no patch evidence could be confirmed from tracked sources. Although the NVD description says the issue is addressed in VAM 4.42.2, no reproducible vendor advisory, release note, or binary has been indexed. Treat affected systems as unpatched until an official update is verified.

Immediate mitigations:

• Contact Selesta support directly to confirm the availability and integrity of version 4.42.2. Do not apply an untrusted “fix” from a third party.
• Restrict network access to the VAM web interface. Place it behind a VPN or dedicated jump host; do not expose /vam/vam_ep.php to the public Internet.
• Enforce strong authentication, MFA, and periodic password resets for all VAM accounts. The authenticated prerequisite means that credential hygiene directly reduces exploitability.
• Review and least-privilege the application’s database service account. Revoke FILE, xp_cmdshell, BULK INSERT, and other administrative privileges.
• Deploy a WAF or reverse proxy in front of VAM that blocks requests to /vam/vam_ep.php containing SQL metacharacters or SQL keywords (virtual patch).
• Alert on abnormal timing or response-size anomalies from the VAM server.
• Monitor database activity for unusual queries issued by the VAM application account.

Patch/upgrade steps (once a verified vendor patch exists):

1. Backup the VAM database and all configuration files.
2. Schedule a maintenance window and notify security teams.
3. Stop the VAM service; remove old application files.
4. Install version 4.42.2 from the official vendor distribution; verify the hash/signature.
5. Run any database schema migrations provided by the vendor.
6. Restart the service and functionally test authentication, user management, and door-access operations.
7. Reapply all hardening measures (network restrictions, MFA, DB privileges) after the upgrade.

Long-term hardening:

• Implement application allow-listing and SQL parameterization in all custom code interacting with the VAM database.
• Conduct periodic DAST and SAST scans of the VAM application before major updates.
• Segment the VAM server from other corporate systems; use host-based firewalls and strict egress controls.
• Deploy a dedicated SIEM ingestion pipeline for VAM logs and create correlation rules for SQLi indicators and unusual access patterns.
• Maintain awareness of the CVE through NVD changes and vendor announcements, since the patch status may change.

References

• NVD entry for CVE-2023-42239: https://nvd.nist.gov/vuln/detail/CVE-2023-42239
• MITRE ATT&CK technique T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• CVE.org record: https://www.cve.org/CVERecord?id=CVE-2023-42239
• FIRST EPSS data: https://www.first.org/epss/
• Selesta official website (for vendor coordination only, no advisory found): https://www.selesta.it/

No known threat-actor campaigns or exploit-in-the-wild evidence has been reported for CVE-2023-42239 as of this report. This finding is consistent with the lack of public PoC, the low EPSS score, and the fact that the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog.