CVE-2023-42240

Executive Summary

CVE-2023-42240 is an authenticated SQL injection vulnerability in Selesta Visual Access Manager (VAM) versions prior to 4.42.2. An attacker holding valid credentials can inject malicious SQL through multiple POST parameters of the /monitor/s_scheduledfile.php endpoint, potentially extracting sensitive data from the underlying database, including user credentials and physical-access configuration. No public proof-of-concept, exploitation-in-the-wild evidence, or vendor advisory has been confirmed at the time of writing, and the vulnerability is not listed in CISA KEV; the EPSS score of 0.00241 (15.6th percentile) indicates a currently low probability of active exploitation.

Technical Analysis

VAM is a web-based physical-access management platform used to control and monitor building entry systems. The vulnerable component, /monitor/s_scheduledfile.php, is a monitoring script responsible for handling scheduled-file operations. According to the NVD description, the flaw exists in VAM releases prior to 4.42.2 and is reachable only after authentication — meaning the attacker must first obtain a valid VAM account.

The vulnerability class is classic SQL injection (CWE-89). The insecure construction of SQL queries likely arises because values supplied through "multiple POST parameters" are concatenated directly into database statements without parameterized queries or server-side sanitization. Because the parameter names, the database management system in use, and the exact query structure are not disclosed in the NVD record, sufficient technical detail to reconstruct a precise payload is unavailable. The attack is therefore understood at the class level: by altering the structure of a SQL statement, an attacker can change its logic (e.g., bypass filters, join additional tables) or use UNION-based / boolean-blind / time-based techniques to exfiltrate arbitrary data.

Several factors increase the severity of this bug despite the absence of a CVSS score:

• Authentication requirement: The attacker already possesses credentials, bypassing network perimeter controls that often block unauthenticated traffic. This reduces the skill barrier for exploitation and makes the flaw attractive to insiders, compromised low-privilege accounts, or attackers who have obtained credentials via phishing.
• Sensitive data at rest: Physical-access management systems typically store personnel records, credential material (badge/PIN data), access schedules, and audit trails. Extraction of this data has direct confidentiality impact.
• Monitoring/logging scope: The endpoint name implies file-scheduling functionality; the database behind it may also support administrative functions, making broad database enumeration plausible once injection is achieved.

As of this report, there is no confirmed patch source (patch confidence 0/4), no public exploit code, and no Nuclei template. The vendor fix is unconfirmed; however, the version boundary "prior to 4.42.2" strongly implies that 4.42.2 is the first release that addresses the issue.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (authenticated SQL injection) and the data provided.

1. Reconnaissance and target identification: The attacker identifies internet-exposed or internal VAM instances. Common discovery techniques include Shodan/Censys queries for the product banner or login page title (e.g., http.title:"Visual Access Manager"), and directory enumeration for /monitor/s_scheduledfile.php. Because authentication is required, target selection will favor instances with weak default credentials, leaked credentials, or exposed session tokens.

2. Authentication: The attacker obtains a valid VAM account. This could be achieved through default/weak credential guessing, credential reuse from prior breaches, or phishing. No authentication bypass is required by this CVE — the attack surface is the authenticated web session.

3. Triggering the flaw: The attacker submits a crafted HTTP POST request to /monitor/s_scheduledfile.php. The payloads are placed in multiple POST body parameters that the application uses to build SQL queries. At the class level, typical payload patterns include:

   • Boolean-based: injecting OR 1=1 to alter query conditions.
   • UNION-based: injecting UNION SELECT ... to extract data from other tables.
   • Time-based/blind: injecting SLEEP() or WAITFOR DELAY to infer data through response timing.
   • Metadata extraction: querying information_schema tables to map the database schema.

   Because the NVD description does not disclose the parameter names, detection must rely on generic SQLi patterns in the POST body rather than parameter-specific signatures.

4. Post-exploitation: A successful injection yields results returned by the database to the application, which are reflected in the HTTP response. The attacker can then enumerate tables, dump credential hashes, extract badge/access-schedule data, and potentially obtain administrator accounts. If the database service account has elevated privileges, an attacker might escalate to reading/writing files on the host OS (via techniques such as INTO OUTFILE or xp_cmdshell, depending on the DBMS), leading to operating-system compromise and lateral movement into the physical-security network segment.

Impact Assessment

The business impact of CVE-2023-42240 centers on the confidentiality and integrity of a physical-access management system. Successful exploitation enables an authenticated attacker to:

• Extract sensitive data: Personnel records, credential material, access schedules, and historical entry logs.
• Compromise administrative accounts: Dumping administrator hashes can lead to full takeover of the VAM platform, allowing the attacker to alter access permissions, disable door controls, or create rogue schedules.
• Pivot within the trust zone: VAM deployments are often adjacent to other security infrastructure (CCTV, alarm systems, badging systems); a database compromise can serve as a beachhead for lateral movement.

The absence of a CVSS score prevents quoting precise severity or confidentiality/integrity/availability subscores. Nevertheless, the vulnerability class is universally regarded as high-severity in web applications. Quantitative risk signals are mixed: EPSS places the chance of exploitation at 0.24% (15.6th percentile of known exploited CVEs), and its absence from the CISA KEV catalog indicates no confirmed in-the-wild exploitation. However, authenticated SQL injection flaws are frequently weaponized once credentials are breached or after the issue is publicly analyzed. The blast radius is bounded to VAM installations running versions prior to 4.42.2, with exposure dependent on the reachability of the web interface.

Detection Guidance

The following rules are designed to detect HTTP POST requests to /monitor/s_scheduledfile.php containing SQL injection payload patterns. They rely on generic SQLi indicators because the specific vulnerable parameters are undisclosed.

Sigma Rule

title: SQL Injection Attempt Against Selesta VAM /monitor/s_scheduledfile.php
id: 8f2d04c9-81b3-4c47-b88e-5d49ab3f1f24
status: experimental
description: Detects SQL injection payload patterns in POST requests to the Selesta Visual Access Manager endpoint /monitor/s_scheduledfile.php (CVE-2023-42240).
logsource:
  category: webserver
detection:
  selection:
    http.method: POST
    http.url|contains: /monitor/s_scheduledfile.php
  keywords:
    - 'union select'
    - 'or 1=1'
    - "' or '"
    - 'sleep('
    - 'waitfor delay'
    - 'information_schema'
    - 'concat('
    - '0x' # hex-encoded payloads
  condition: selection and keywords
falsepositives:
  - Legitimate database-related searches in scheduled-file content
level: high

YARA Rule

rule CVE_2023_42240_Selesta_VAM_SQLi {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects SQL injection payloads targeting Selesta Visual Access Manager /monitor/s_scheduledfile.php"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-42240"
        date = "2025-01-01"
    strings:
        $uri = "/monitor/s_scheduledfile.php" ascii nocase
        $sqli1 = "union select" ascii nocase
        $sqli2 = "or 1=1" ascii nocase
        $sqli3 = "sleep(" ascii nocase
        $sqli4 = "waitfor delay" ascii nocase
        $sqli5 = "information_schema" ascii nocase
        $sqli6 = "benchmark(" ascii nocase
        $sqli7 = "extractvalue(" ascii nocase
    condition:
        $uri and any of ($sqli*)
}

Suricata IDS Rule

alert http $EXTERNAL_NET any -> $HOME_NET any ( \
    msg:"CVE-2023-42240 - Selesta VAM SQL Injection Attempt Against /monitor/s_scheduledfile.php"; \
    flow:established,to_server; \
    http.method; content:"POST"; \
    http.uri; content:"/monitor/s_scheduledfile.php"; nocase; \
    http.request_body; content:"union select"; nocase; \
    http.request_body; content:"or 1=1"; nocase; \
    http.request_body; content:"information_schema"; nocase; \
    http.request_body; content:"sleep("; nocase; \
    http.request_body; content:"waitfor delay"; nocase; \
    classtype:web-application-attack; \
    sid:202342240; rev:1;)

Elastic Detection

any where network.protocol == "http" and http.request.method == "POST"
  and url.path == "/monitor/s_scheduledfile.php"
  and (
    http.request.body.content like "*union select*"
    or http.request.body.content like "*or 1=1*"
    or http.request.body.content like "*waitfor delay*"
    or http.request.body.content like "*information_schema*"
    or http.request.body.content like "*sleep(*"
  )

Splunk SPL Query

index=web (sourcetype="access_combined" OR sourcetype="iis*")
  method=POST uri_path="/monitor/s_scheduledfile.php"
| regex _raw="(?i)(union\s+select|or\s+1=1|waitfor\s+delay|information_schema|sleep\s*\()"
| eval threat_name="CVE-2023-42240_SQLi_Attempt", severity="high"
| table _time, src_ip, dest_ip, dest_port, uri_path, http_user_agent, _raw
| sort - _time

Wazuh OSSEC Rule

<group name="web,sql_injection,">
    <rule id="100423" level="10">
        <decoded_as>web</decoded_as>
        <description>CVE-2023-42240 - Selesta VAM SQL injection attempt against /monitor/s_scheduledfile.php</description>
        <match>/monitor/s_scheduledfile.php</match>
        <regex>(?i)(union\s+select|or\s+1=1|waitfor\s+delay|information_schema|sleep\s*\()</regex>
        <group>attack_pattern_1190,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor advisory, code commit, or binary patch has been identified in any tracked source. The NVD description states the flaw affects versions "prior to 4.42.2," which implies 4.42.2 contains the fix; this should be verified directly with Selesta before assuming safe upgrade.

1. Immediate mitigations:

   • Upgrade to Selesta VAM 4.42.2 (or later) as soon as the vendor confirms release availability.
   • If an immediate upgrade is impossible, restrict network access to the VAM web interface — particularly /monitor/s_scheduledfile.php — to trusted administrative networks via firewall or reverse-proxy ACLs.
   • Deploy a WAF rule that blocks POST requests to /monitor/s_scheduledfile.php containing common SQL injection patterns (UNION SELECT, OR 1=1, SLEEP(), WAITFOR DELAY, information_schema).
   • Enforce strong unique passwords and multi-factor authentication for all VAM accounts, prioritizing administrative users.
   • Audit existing VAM accounts for stale, shared, or default credentials and revoke those that are unnecessary.

2. Patch/upgrade steps:

   • Obtain the 4.42.2 release from Selesta (or the distribution channel used by the organization).
   • Back up the VAM configuration and database before upgrading.
   • Schedule the upgrade during a maintenance window; validate scheduled-file functionality and physical-access controller synchronization after deployment.

3. Long-term hardening:

   • Demand that the vendor remediate the root cause via parameterized/prepared statements and automated SAST in the development pipeline.
   • Run the VAM database service account with least privilege; revoke file-system write and OS command-execution rights.
   • Segment the physical-security management network from general corporate IT to contain lateral movement (as referenced by MITRE ATT&CK T1190).
   • Enable verbose SQL-error logging on the application database and forward logs to the SIEM for post-incident forensics.
   • Monitor vendor advisories and the CVE record for the eventual availability of an official patch or additional technical details.

References

• NVD — CVE-2023-42240 Detail: https://nvd.nist.gov/vuln/detail/CVE-2023-42240
• CVE.org — CVE Record: https://www.cve.org/CVERecord?id=CVE-2023-42240
• FIRST — EPSS Score for CVE-2023-42240: https://www.first.org/epss/search?cve=CVE-2023-42240
• CISA KEV Catalog — CVE not listed (confirmed as of report date; no in-the-wild exploitation evidence).
• No vendor advisory or researcher analysis is publicly available at the time of writing; no threat-actor campaigns currently reference this CVE in open-source intelligence.