CVE-2023-42243

Executive Summary

CVE-2023-42243 is an authenticated arbitrary SQL query vulnerability in Selesta Visual Access Manager (VAM) versions prior to 4.42.2. Any authenticated user can access the administrative script /common/vam_Sql.php, which permits the execution of arbitrary SQL statements against the backing database. Successful exploitation yields complete database compromise, including credential exposure, data tampering, and potential downstream access to physical access-control infrastructure.

Technical Analysis

Selesta Visual Access Manager is a web-based physical access control and visitor management platform. The vulnerability resides in an administrative PHP script exposed under /common/vam_Sql.php. Based on the NVD description, the endpoint accepts requests from any logged-in user and executes arbitrary SQL queries. The NVD description does not enumerate the exact request parameters, HTTP methods, or code-level sanitization logic, but the functional behavior described — "arbitrary SQL queries" — indicates that user-supplied SQL content is passed to the database backend without validation, parameterization, or an authorization check that would restrict access to privileged administrators.

Two distinct weaknesses converge in this single endpoint:

1. Missing access-control enforcement: The administrative page is reachable by any authenticated user, not only users with administrative roles. This is a broken object-level authorization / improper privilege management issue that expands the attack surface to the entire authenticated user population of VAM.
2. Unrestricted SQL execution: The script behaves as a SQL shell — a functionality that is inherently dangerous when exposed to any user. There is no evidence of input sanitization, allow-listing of query types, read-only enforcement, or per-query authorization.

The vulnerability class is SQL injection in the broadest sense (CWE-89), but it is more accurately characterized as an exposed administrative SQL console. The NVD description does not specify the underlying DBMS (e.g., MySQL, PostgreSQL, Microsoft SQL Server), which means the exact escalation paths vary by deployment. The page name vam_Sql.php strongly suggests this is a native debugging or administration facility that was either left enabled in production or provided without adequate authentication granularity.

No CWE, CVSS score, or vendor fix has been assigned in the NVD record as of this analysis. The EPSS score is 0.00240, placing it in approximately the 15th percentile of exploited CVEs, indicating a low observed exploitation rate. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. Patch confidence is 0/4, meaning no tracked patch source contains evidence of a vendor fix. The affected version range is all releases before 4.42.2.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code has been identified for this CVE. The attack chain below is inferred strictly from the NVD description and the vulnerability class.

Step 1 — Reconnaissance and target identification. An attacker identifies internet-exposed Selesta Visual Access Manager deployments by fingerprinting the web application (login page title, favicon, or product-specific scripts). Shodan-style queries such as http.title:"Visual Access Manager" or searches for the vam_Sql.php path can surface candidate targets. The attacker also needs valid credentials; because the flaw affects "an authenticated user," any account with standard user privileges is sufficient. Credentials may be obtained via phishing, brute-force attacks, default account testing, or credential reuse from prior breaches.

Step 2 — Triggering the flaw. With valid credentials, the attacker authenticates to the VAM web interface and issues an HTTP request to the administrative endpoint /common/vam_Sql.php. Because the description states the page "allows for arbitrary SQL queries," the attacker submits a SQL statement as part of the request. The exact parameter name is not disclosed in the NVD description; at the class level, the request carries the attacker-controlled query in a GET or POST parameter that the script forwards to the database engine.

Step 3 — Payload execution. The vulnerability-class execution is a direct SQL query submission. Rather than injecting into an existing query (classic injection), the attacker supplies a complete SQL statement, for example a SELECT to enumerate users, or UNION-based payloads if the interface concatenates clauses. Successful authentication to the endpoint implies the query executes with the database privileges of the VAM application account. If the underlying database permits stacked queries and the application account has elevated rights, the attacker can also attempt INSERT, UPDATE, DELETE, or database-specific features such as file write (INTO OUTFILE) or command execution (xp_cmdshell on SQL Server). These latter paths are dependent on DBMS and deployment configuration and are not confirmed by the NVD description — insufficient technical detail is available to assert them definitively.

Step 4 — Post-exploitation impact. The attacker can dump the entire application database, including user account tables, password hashes, and configuration records. Because VAM is an access-control platform, the database may contain personnel records, badge/credential identifiers, door schedules, and audit logs. Data can be exfiltrated for further attacks, or modified to enroll attacker-controlled credentials or alter access policies. In environments where the application database account has broad privileges, the attacker could potentially escalate to operating-system-level access, with the DBMS serving as the pivot point.

Impact Assessment

The most direct impact is confidentiality loss: any authenticated user — including low-privilege operators, contractors, or compromised accounts — can read the entire VAM database. This is functionally equivalent to a database administrator having no query restrictions, which in an access-control context can expose sensitive physical-security data.

Integrity impact is equally severe: arbitrary UPDATE, INSERT, and DELETE statements allow an attacker to alter user permissions, modify access schedules, forge audit trails, or lock out legitimate users. Availability impact arises from destructive statements (e.g., dropping tables) or resource-exhaustive queries that degrade the application database and disrupt physical access operations.

The blast radius extends beyond the database itself. VAM is physically linked to doors, badges, and visitor workflows; database compromise can translate into unauthorized physical entry if access rules are modified. In networked deployments, the database server may be on an internal segment, enabling lateral movement from the web tier to other backend systems.

No CVSS score is available to quantify severity numerically. The absence of a score, combined with patch confidence 0/4, means defenders must treat this as an unquantified but high-risk authorization and SQL-execution flaw. The low EPSS score suggests attackers have not widely weaponized it, but the low barrier to exploitation (any valid account) makes it an attractive target for targeted campaigns against facilities using Selesta VAM.

Detection Guidance

The following detection content targets HTTP requests to the known administrative path /common/vam_Sql.php and, where feasible, SQL keywords in the request body. Tune false positives to your environment — authorized administrators may legitimately use this functionality.

Sigma Rule

title: Selesta Visual Access Manager Arbitrary SQL Query Endpoint Access
id: 7c3fba19-4c81-4c6b-9a52-3d8e0f2a1b44
status: experimental
description: Detects HTTP requests to the Selesta VAM administrative SQL interface /common/vam_Sql.php associated with CVE-2023-42243. Any authenticated user can execute arbitrary SQL via this endpoint.
logsource:
  category: webserver
  product: apache
detection:
  selection_path:
    cs-uri-path:
      - '/common/vam_Sql.php'
  selection_sql:
    cs-uri-query|contains:
      - 'select'
      - 'union'
      - 'insert'
      - 'update'
      - 'delete'
      - 'drop'
      - 'exec'
  condition: selection_path and selection_sql
  timeframe: 5m
level: high
fields:
  - c-ip
  - cs-username
  - sc-status
falsepositives:
  - Authorized database administration activity by VAM administrators

YARA Rule

rule CVE_2023_42243_Selesta_VAM_SQL_Endpoint
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects web artifacts, logs, or captured traffic referencing the Selesta Visual Access Manager administrative SQL endpoint exploited in CVE-2023-42243"
        cve = "CVE-2023-42243"
        date = "2025-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-42243"
    strings:
        $s1 = "common/vam_Sql.php" ascii wide nocase
        $s2 = "vam_Sql.php" ascii wide nocase
        $s3 = "Visual Access Manager" ascii wide nocase
        $s4 = "Selesta" ascii wide nocase
    condition:
        any of ($s1, $s2) and 1 of ($s3, $s4)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2023-42243 Selesta VAM Arbitrary SQL Query Endpoint Access"; flow:to_server,established; http.uri; content:"/common/vam_Sql.php"; nocase; classtype:web-application-activity; sid:202342243; rev:1;)

alert http any any -> any any (msg:"CVE-2023-42243 Selesta VAM SQL Injection Payload in Request"; flow:to_server,established; http.uri; content:"/common/vam_Sql.php"; nocase; http.request_body; pcre:"/(SELECT|UNION\s+SELECT|INSERT\s+INTO|UPDATE\s+\w+|DELETE\s+FROM|DROP\s+TABLE|EXEC\s|xp_cmdshell|INTO\s+OUTFILE)/i"; sid:202342244; rev:1;)

Elastic Detection

network where event.category == "network" and network.protocol == "http"
    and url.path == "/common/vam_Sql.php"
    and (
        url.query like~ "*select*"
        or url.query like~ "*union*"
        or url.query like~ "*insert*"
        or url.query like~ "*delete*"
        or url.query like~ "*drop*"
        or url.query like~ "*exec*"
    )

For access-log-based detection:

any where event.category == "web" and http.request.path == "/common/vam_Sql.php"
    and (http.request.body.content like~ "*select*" or http.request.body.content like~ "*union*")

Splunk SPL Query

index=web sourcetype=access_combined uri_path="/common/vam_Sql.php"
| eval suspicious = if(match(uri_query, "(?i)(select|union|insert|update|delete|drop|exec|xp_cmdshell|into outfile)") OR match(http_user_agent, "(?i)(sqlmap|havij|jbrofuzz)"), "true", "false")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip user uri_path uri_query status suspicious
| where suspicious = "true" OR count > 10
| sort - count

Wazuh OSSEC Rule

<group name="web_application_attack,">
  <rule id="100422" level="12">
    <decoded_as>web</decoded_as>
    <match>vam_Sql\.php</match>
    <regex>common/vam_Sql\.php</regex>
    <description>Selesta Visual Access Manager SQL endpoint accessed by authenticated user (CVE-2023-42243)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,</group>
  </rule>

  <rule id="100423" level="15">
    <if_sid>100422</if_sid>
    <match>(?i)(select|union|insert|update|delete|drop|exec|xp_cmdshell|into outfile)</match>
    <description>SQL keywords observed in request to Selesta VAM SQL endpoint - possible arbitrary query execution (CVE-2023-42243)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch evidence exists from any tracked source, and no vendor advisory or fixed build has been confirmed. The following actions should be treated as compensating controls, not as a replacement for an official fix.

1) Immediate mitigations:

• Restrict network access to /common/vam_Sql.php at the web server or reverse-proxy layer. Block the path via ACLs or rewrite rules for all users except a narrowly scoped set of administrative IP addresses. If the page is not required for routine operations, disable the script entirely.
• If feasible, remove or rename the vam_Sql.php file from the web root after verifying no legitimate workflow depends on it, and test administrative functions for regressions.
• Audit all user accounts and enforce least privilege. Since any authenticated user is affected, disable dormant or shared accounts and rotate credentials for all VAM users.
• Enforce multi-factor authentication on the VAM web interface to reduce the likelihood of credential compromise.
• Place the web application and database behind a properly configured WAF with rules blocking direct SQL keywords in requests, especially to administrative paths.

2) Patch/upgrade steps:

• Contact Selesta support to confirm whether versions at or above 4.42.2 address this issue; the version constraint in the NVD description implies a fixed release exists, but no advisory has been published in the tracked sources.
• Upgrade to 4.42.2 or any later release once verified, following the vendor's upgrade procedure and validating all access-control workflows afterward.
• If no fixed release is available, treat the product as end-of-life for this control plane and escalate to vendor management / procurement with a request for a security patch.

3) Long-term hardening:

• Segment the VAM application and its database from the general corporate network; do not expose the administrative interface to the internet.
• Use a dedicated, least-privileged database account for the application, one that lacks FILE, EXECUTE, or cross-database privileges, to limit the impact of arbitrary SQL execution.
• Enable database-level auditing and log all queries to a SIEM; alert on unexpected SELECT of user tables or any INSERT/UPDATE/DELETE activity outside maintenance windows.
• Maintain an inventory of all internet-facing instances of Selesta VAM and prioritize this CVE during any credential-reuse or account-takeover investigations.

References

1. NVD — CVE-2023-42243: https://nvd.nist.gov/vuln/detail/CVE-2023-42243
2. CVE.org Record — CVE-2023-42243: https://www.cve.org/CVERecord?id=CVE-2023-42243
3. FIRST EPSS — CVE-2023-42243 entry (EPSS score 0.00240): https://www.first.org/epss/
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2023-42243 is not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No vendor advisory, researcher analysis, or public exploit publication was identified in the input data for this CVE. No threat-actor campaigns or exploit-in-the-wild evidence are known at the time of writing. Analysts should monitor the NVD record and vendor channels for a future advisory, as the current patch confidence of 0/4 indicates an unpatched status across all tracked sources.