CVE-2023-42242

Executive Summary

CVE-2023-42242 is an authenticated SQL injection vulnerability in Selesta Visual Access Manager (VAM) versions prior to 4.42.2, reachable through a GET parameter of the /monitor/s_terminal.php endpoint. A user with valid VAM credentials can inject SQL statements into this parameter, enabling database enumeration, data exfiltration, and potentially modification of physical access control records. The vulnerability currently has no CVSS score, no known public exploit code, and no confirmed patch from any tracked source, leaving affected deployments in a vulnerable state; defensive measures must therefore rely on detection and compensating controls.

Technical Analysis

The NVD description is sparse and discloses only the following concrete technical details:

• Affected product: Selesta Visual Access Manager (VAM).
• Affected versions: prior to 4.42.2.
• Vulnerability class: SQL injection.
• Attack vector: authenticated attacker.
• HTTP endpoint: /monitor/s_terminal.php, with injection performed via a GET parameter.

The endpoint path indicates the vulnerability resides in the monitoring/terminal management subsystem of VAM — s_terminal.php most plausibly services terminal device query or status functions — though the NVD description does not disclose the vulnerable parameter name, the underlying database management system, or the query structure. Per critical accuracy rules, no such implementation details will be guessed here.

At the vulnerability-class level, the flaw indicates that a value supplied by an authenticated client through the GET request is concatenated into a server-side SQL query without parameterization or sanitization. Because the attacker must already be authenticated, this is not a pre-authentication SQL injection; it represents a privilege escalation and data exposure issue that compounds any pre-existing trust placed in authenticated VAM users (e.g., lower-privileged operators, security guards, or badge administrators).

The attack surface is the VAM web interface itself. VAM products in this class manage physical access infrastructure, typically storing personnel records, badge/card identifiers, access schedules, door/terminal assignments, and audit logs in a backend database. The /monitor/ path segment suggests the endpoint is part of real-time monitoring functions to which operators have legitimate access, meaning the vulnerable surface is exposed to all authenticated users of the console, not just administrators.

Technical limitations of the available data are noteworthy:

• No CWE is assigned in the NVD record, though the description's explicit "SQL Injection" phrase maps unambiguously to CWE-89.
• No CVSS score or vector is available; risk scoring teams must perform their own assessment.
• EPSS score is 0.00321 (24.9th percentile of exploited CVEs), indicating a relatively low current probability of exploitation in the wild.
• CISA KEV does not list this CVE, and no known threat-actor campaigns reference it.

Because no parameter names, DBMS information, or patch diff details are available, detection and mitigation must operate on the observable HTTP artifact (/monitor/s_terminal.php with anomalous query strings) rather than on a specific payload signature.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2023-42242; the attack chain below is inferred from the vulnerability class and the description, not from observed exploits.

Step 1 — Reconnaissance / target identification.
An attacker identifies internet-exposed Selesta VAM instances using the Shodan dorks listed in the metadata (e.g., searching for "Visual Access Manager" titles or s_terminal.php references). Version identification may be performed via login page fingerprinting or unauthenticated resource disclosure. Because the vulnerability requires authentication, the attacker must additionally obtain valid VAM credentials — via credential stuffing, default-credential testing, phishing of facility staff, or password reuse from other breaches.

Step 2 — Triggering the flaw.
With valid credentials, the attacker authenticates to the VAM web console and issues an HTTP GET request directly to /monitor/s_terminal.php, appending a crafted GET parameter value. Access logs and web server filters will show the request as a normal authenticated GET, which evades naive network-layer allowlists that only check source IP or authentication state.

Step 3 — Payload / execution method (vulnerability-class level).
The attacker injects SQL metacharacters and clauses into the GET parameter to alter the backend query's logic. Typical class-level techniques include:

• Boolean-based injection (e.g., injecting OR 1=1-style conditions with encoded whitespace/equals characters) to alter query result sets.
• UNION-based injection to append attacker-controlled rows to the result set and extract data from other tables.
• Time-based blind injection (e.g., SLEEP(...) or BENCHMARK(...) constructs) to infer data when no visible error or result set is reflected.

Since the exact parameter name and query context are unknown, the payload shape will vary; the common denominator is the presence of SQL keywords, quotes, or encoded quote characters in the GET query string of the single endpoint.

Step 4 — Post-exploitation impact.
Successful injection grants the attacker the same privileges as the database account used by the VAM application — often elevated relative to the authenticated VAM role. With the ability to run arbitrary SELECT and potentially INSERT/UPDATE/DELETE statements, the attacker can:

• Extract personnel records, badge identifiers, visitor logs, access schedules, and credential hashes from the VAM database.
• Modify access rights or delete audit logs, enabling physical-security bypass and cover-up of malicious activity.
• Potentially pivot to the underlying database server or integrate with connected LDAP/Active Directory services if the VAM service account holds elevated database permissions.

The business consequence extends past data theft: a compromise of the physical access management system undermines the confidentiality, integrity, and availability of physical access controls for all facilities managed by the affected VAM deployment.

Impact Assessment

Selesta Visual Access Manager is a physical access management product; the threat model is therefore broader than typical web-application SQL injection. A successful exploit can expose personally identifiable information (PII) of employees and visitors, alter physical access policies, disable or re-enable door/terminal access, and tamper with audit evidence relevant to regulatory compliance (e.g., GDPR, facility security standards).

The NVD record assigns no CVSS score or vector, so a quantitative score cannot be quoted here. Risk assessors should independently evaluate confidentiality, integrity, and availability impacts; the direction of this evaluation should be high, given authenticated access plus SQL injection on a physical-security control plane. The exploitability side is moderated by the authentication requirement: an attacker already possessing VAM credentials has a foothold, so the marginal gain is privilege escalation from application-user to database-level control.

Blast radius includes all data managed by the compromised VAM instance — terminals, cardholders, schedules, events — and any downstream systems that trust VAM data (e.g., identity management, alarm systems, visitor management). EPSS 0.00321 and the absence of a CISA KEV listing indicate that broad in-the-wild exploitation has not yet been observed; this is a proactive remediation window, not a reason for delay, especially given the 0/4 patch confidence.

Detection Guidance

Detection for CVE-2023-42242 must focus on HTTP request characteristics: the vulnerable endpoint path plus SQLi indicators in the query string. All rules below assume web server or reverse proxy logs with URI and query-string visibility. Tune false positives for login pages or search-like functions before enabling in production.

Sigma Rule

title: Selesta VAM CVE-2023-42242 SQL Injection Attempt on /monitor/s_terminal.php
id: 0a3f9b31-8c42-4f76-9f2a-1e6b14c96a20
status: experimental
description: Detects HTTP GET requests targeting /monitor/s_terminal.php containing SQL injection indicators.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-42242
author: ValtersIT Threat Intelligence
date: 2025/01/01
logsource:
    category: webserver
    product: apache
    definition: Web server access logs (combined format) or reverse proxy access logs.
detection:
    selection_endpoint:
        cs-uri-path: '/monitor/s_terminal.php'
    selection_sqli:
        cs-uri-query|contains:
            - "'"
            - '%27'
            - 'UNION'
            - 'SELECT'
            - 'union select'
            - 'sleep('
            - 'benchmark('
            - 'OR 1=1'
            - '%3D'
    condition: selection_endpoint and selection_sqli
falsepositives:
    - Application functionality that legitimately passes the words 'select' or 'union' as parameter values.
    - URL-encoded legitimate values containing apostrophes, e.g., O'Neil.
level: high
tags:
    - attack.t1190
    - cve.2023-42242
    - cwe.89

YARA Rule

rule CVE_2023_42242_Selesta_VAM_SQLi_Logs
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Matches web server access log lines or captured HTTP traffic containing SQLi attempts against Selesta VAM /monitor/s_terminal.php"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-42242"
        cve = "CVE-2023-42242"
        date = "2025-01-01"
    strings:
        $a = "/monitor/s_terminal.php" ascii
        $b = /(union\s+select|UNION\s+SELECT)/ ascii
        $c = /sleep\s*\(/ ascii
        $d = /benchmark\s*\(/ ascii
        $e = /\bOR\b.{0,8}1\s*=\s*1/ ascii
        $f = "%27" ascii
    condition:
        $a and 2 of ($b, $c, $d, $e, $f)
}

This rule is intended for scanning web server access logs, packet captures, or SIEM-exported HTTP artifacts. The %27 string catches URL-encoded single quotes commonly used to break out of SQL string literals.

Suricata IDS Rule

alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"SELESTA VAM CVE-2023-42242 SQL Injection Attempt on /monitor/s_terminal.php"; flow:established,to_server; http.uri; content:"/monitor/s_terminal.php"; http.uri; pcre:"/(union[[:space:]]+select|select[[:space:]]+from|sleep[[:space:]]*\(|benchmark[[:space:]]*\(|%27|or[[:space:]]+1[[:space:]]*=[[:space:]]*1)/i"; classtype:web-application-attack; reference:cve,2023-42242; sid:20234242; rev:1;)

The rule triggers on the vulnerable URI path in combination with class-level SQLi patterns, including encoded quotes, union/select constructs, and time-based payload primitives.

Elastic Detection

any where http.request.method == "GET"
    and url.path == "/monitor/s_terminal.php"
    and (wildcard(url.query, "*%27*")
         or wildcard(url.query, "*union*select*")
         or wildcard(url.query, "*select*from*")
         or wildcard(url.query, "*sleep(*")
         or wildcard(url.query, "*benchmark(*")
         or wildcard(url.query, "*or*1*%3D*1*")
         or wildcard(url.query, "*1=1*"))

The EQL query matches authenticated and unauthenticated HTTP GET requests to the vulnerable endpoint with SQLi-class artifacts in the query string. Combine with event.module == "nginx" or the relevant web server module for production deployment.

Splunk SPL Query

index=web* sourcetype=iis OR sourcetype=access_combined
uri_path="/monitor/s_terminal.php"
(uri_query IN ("*union*select*", "*%27*", "*sleep(*", "*benchmark(*", "*1=1*", "*or 1=1*")
  OR match(uri_query, "(?i)union\s+select|sleep\s*\(|benchmark\s*\(|1\s*=\s*1|%27"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, uri_query, status
| sort - count

The match() clause provides regex coverage for unexpected whitespace/encoding variants, while the IN list catches the most common plain-text payload forms. Adjust the index and sourcetype values to match your web log pipeline.

Wazuh OSSEC Rule

<group name="web,sql_injection,">
  <rule id="100423" level="10">
    <decoded_as>web</decoded_as>
    <url>/monitor/s_terminal.php</url>
    <regex>(\bunion\s+select\b|%27|sleep\s*\(|benchmark\s*\(|1\s*=\s*1)</regex>
    <description>Selesta VAM (CVE-2023-42242) SQL injection attempt detected on /monitor/s_terminal.php</description>
    <group>web_application_attack,sql_injection,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

The rule fires at level 10 (high) when a web log entry references the vulnerable endpoint and contains SQLi indicators. Add this rule to a local ruleset file and test against benign VAM traffic before full deployment.

Mitigation & Patch Guidance

Patch confidence for CVE-2023-42242 is 0/4 — no tracked source has confirmed a vendor fix. The NVD version window ("prior to 4.42.2") suggests Selesta may have addressed the issue in version 4.42.2, but this has not been independently verified. Treat any upgrade claim with caution and verify directly with Selesta support before relying on it.

1. Immediate mitigations (compensating controls):

   • Deploy a WAF in front of the VAM web console with rules blocking SQLi patterns specifically on /monitor/s_terminal.php, including URL-encoded variants (%27, %3D, %2F).
   • Restrict network access to the VAM console by source IP / VPN so that only trusted administrators and operators can reach /monitor/*.
   • Audit existing VAM accounts; remove dormant accounts and enforce least-privilege roles so that operators have no more access than their duties require.
   • Monitor the /monitor/s_terminal.php endpoint aggressively using the detection rules above; alert on any anomalous query strings from authenticated sessions.

2. Patch / upgrade steps:

   • Contact Selesta to confirm whether version 4.42.2 resolves CVE-2023-42242 and obtain the official advisory and patch notes.
   • If confirmed, upgrade all VAM deployments to 4.42.2 or later in a maintenance window, following the vendor's backup and rollback procedure.
   • If the vendor cannot confirm a fix, assume the product remains vulnerable and treat it as exposed requiring ongoing compensating controls.

3. Long-term hardening:

   • Require MFA for all VAM console accounts to reduce the risk of credential-based exploitation of this authenticated flaw.
   • Ensure the VAM application runs with a database account limited to the minimum required privileges; prohibit the use of administrative DB accounts (e.g., sa, root) for the application.
   • Maintain full web-log retention for the VAM console with SIEM integration, preserving at least 12 months for forensics and compliance.
   • Segment the VAM network from general corporate and internet-facing zones; never expose the management console directly to the internet.
   • Enforce strong password policy and credential-stuffing protections on the VAM authentication layer.
   • Revisit this CVE's patch status quarterly until an official fix is confirmed.

References

1. NVD — CVE-2023-42242: https://nvd.nist.gov/vuln/detail/CVE-2023-42242
2. CVE.org Record — https://www.cve.org/CVERecord?id=CVE-2023-42242
3. FIRST EPSS (score 0.00321, 24.9th percentile): https://www.first.org/epss/
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2023-42242 NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No vendor advisory, researcher analysis, or exploit-in-the-wild evidence was identified for CVE-2023-42242 at the time of writing. No threat-actor campaigns have been publicly attributed to this CVE. Readers should re-check the NVD record and vendor channels for updates to patch status and for any newly published technical analysis.