CVE-2023-42244

Executive Summary

CVE-2023-42244 is an authenticated SQL injection vulnerability in Selesta Visual Access Manager (VAM) versions prior to 4.42.2. The flaw is reachable through multiple POST parameters accepted by the /vam/vam_visits.php endpoint, meaning any authenticated user of the web application — including low-privileged operator accounts — can manipulate the underlying database queries. Successful exploitation can lead to disclosure of the VAM database contents, including visitor records, access-management data, and potentially credentials, with a realistic path toward account takeover and compromise of the physical security management platform. No CVSS score, CWE assignment, or official vendor advisory is currently published by NVD, so severity must be assessed contextually based on the sensitive data the product manages.

Technical Analysis

Selesta Visual Access Manager is a web-based platform used to manage physical access, visitor registration, and related security workflows. The vulnerable resource, /vam/vam_visits.php, is served over HTTP/HTTPS and consumes an HTTP POST request body composed of multiple named parameters. According to the NVD description, the application fails to properly sanitize or parameterize the values of multiple POST parameters before incorporating them into SQL statements. The specific parameter names are not disclosed in the NVD description or CNA title, so this analysis is intentionally kept at the vulnerability-class level (CWE-89: Improper Neutralization of Special Elements Used in an SQL Command).

The key architectural detail is the authentication requirement. Because the attacker must already have a valid session, the application's authentication boundary has already been passed. The injection therefore defeats the data-level authorization boundary: instead of being restricted to the rows and columns exposed by the UI, the attacker can issue arbitrary operations with the privileges of the database user configured in the web application. The underlying DBMS (MySQL, PostgreSQL, Microsoft SQL Server, Oracle, etc.) is not disclosed in the CVE data, which matters for post-exploitation behavior — stacked queries, file writes, and command execution differ per engine. This report does not assume a specific backend.

The existence of multiple injectable parameters increases the reliability of exploitation: an attacker who encounters input filtering on one parameter can pivot to the others. Because no public proof-of-concept is available, the exact payload mechanics (boolean-based blind, UNION-based, time-based, or error-based) cannot be confirmed. However, the endpoint's placement in a visitor-management workflow suggests the parameters likely feed SELECT/INSERT/UPDATE operations on visitor and visit records, which are commonly exploitable with classic SQL injection primitives.

Exploitation Scenarios

No public PoC is available for CVE-2023-42244; the attack chain below is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance and target identification: An attacker locates exposed VAM instances via internet-wide scanning or directory enumeration. The /vam/ path and the vam_visits.php resource are suitable fingerprinting markers (see Shodan dorks in METADATA). The attacker may also enumerate the product's login interface to confirm the version is prior to 4.42.2.

2. Gaining a valid session: Since the vulnerability is post-authentication, the attacker must obtain valid credentials. Realistic acquisition methods include credential stuffing, phishing of low-privileged operator accounts, or abuse of shared/default credentials if present in the target environment. The NVD description does not indicate a privilege requirement beyond "authenticated attacker," so any application role is a candidate.

3. Triggering the injection: The attacker submits a crafted HTTP POST request to /vam/vam_visits.php. The malicious content is placed in the vulnerable POST parameters at the vulnerability-class level. Typical payload categories include boolean-based tautologies (e.g., ' OR '1'='1), UNION-based probes to enumerate tables and columns (e.g., UNION SELECT), and time-based delay primitives (e.g., WAITFOR DELAY, SLEEP()) for blind inference of the schema. The exact syntax depends on the backend DBMS, which is not disclosed in the CVE data.

4. Post-exploitation impact: A successful injection yields the database privileges of the web application's connection account. The attacker can dump visitor records, access-log data, user tables, and password hashes; modify or delete rows to manipulate visit history or access decisions; and potentially escalate to administrative functions inside VAM. Depending on the DBMS and its configuration, stacked queries could enable creating new application users or, in misconfigured deployments, reading/writing files on the database host. Lateral movement into the physical access control network is plausible given VAM's integration role.

Impact Assessment

The primary business impact is confidentiality loss of sensitive physical-security data. VAM deployments store personally identifiable information about visitors and staff, visit histories, badge/credential identifiers, and access-policy data. In many jurisdictions — especially where the vendor operates (European Union) — this data falls under GDPR, making a breach a regulatory and disclosure event.

Integrity impact is equally serious: an attacker who can modify database rows can forge visit records, disable access traces, or alter the access-rights data that downstream physical readers rely on. Availability impact may follow from destructive SQL statements (DROP, TRUNCATE) or from denial-of-service via resource-exhausting queries. The blast radius therefore extends beyond the web tier to the database host and, indirectly, to the physical access infrastructure.

CVSS risk context is limited: no CVSS score or vector has been assigned by NVD (N/A). This report does not extrapolate a score. Supporting metrics are also sparse — EPSS stands at 0.00385 (31.7th percentile of exploited CVEs), indicating a low but non-negligible exploitation likelihood. The CVE is not listed in CISA KEV, and no in-the-wild exploitation campaigns or public exploit code have been identified at the time of writing.

Detection Guidance

Because no public exploit template exists, detection should focus on (a) SQL injection signatures in requests targeting /vam/vam_visits.php, and (b) anomalous database activity attributable to the web application's database account.

Sigma Rule

title: Selesta VAM CVE-2023-42244 SQL Injection in vam_visits.php
id: 7f9c2c1e-9b3a-4d5e-8f0a-1c2d3e4f5a6b
status: experimental
description: Detects HTTP POST requests to /vam/vam_visits.php containing SQL injection payload patterns.
logsource:
  category: webserver
  product: apache
  definition: Requires web server access logs with POST body or combined logging fields.
detection:
  selection:
    cs-method: POST
    cs-uri-path: /vam/vam_visits.php
  selection_sqli:
    - cs-body|contains:
        - "' OR '"
        - "UNION SELECT"
        - "UNION ALL SELECT"
        - "WAITFOR DELAY"
        - "SLEEP("
        - "BENCHMARK("
        - "OR 1=1"
  condition: selection and selection_sqli
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - sc-status
falsepositives:
  - Legitimate database query strings appearing in search or filter fields
  - Security scanner traffic using the same generic SQLi signatures
level: high

YARA Rule

rule CVE_2023_42244_Selesta_VAM_SQLi {
    meta:
        author = "Valtersit.com Threat Intelligence"
        description = "Detects HTTP artifacts containing SQL injection patterns targeting Selesta VAM vam_visits.php"
        cve = "CVE-2023-42244"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-42244"
        score = "N/A"
    strings:
        $uri = "vam_visits.php" ascii nocase
        $sqli_union = "union select" ascii nocase
        $sqli_or = "or 1=1" ascii nocase
        $sqli_quote = "' or '" ascii nocase
        $sqli_wait = "waitfor delay" ascii nocase
        $sqli_sleep = "sleep(" ascii nocase
        $sqli_bench = "benchmark(" ascii nocase
        $sqli_hex = "0x" ascii nocase
    condition:
        $uri and 2 of ($sqli_*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2023-42244 Selesta VAM vam_visits.php SQL Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/vam/vam_visits.php"; http.request_body; pcre:"/(?i)(union\s+(all\s+)?select|\x27\s*or\s+\x27|waitfor\s+delay|sleep\s*\(|benchmark\s*\()/"; classtype:web-application-attack; reference:cve,2023-42244; sid:10042244; rev:1;)

Elastic Detection

// Elastic EQL on HTTP/network events
any where http.request.method == "POST"
    and http.request.uri == "/vam/vam_visits.php"
    and (
        http.request.body like "*UNION SELECT*"
        or http.request.body like "*UNION ALL SELECT*"
        or http.request.body like "*OR 1=1*"
        or http.request.body like "*WAITFOR DELAY*"
        or http.request.body like "*SLEEP(*"
        or http.request.body like "*BENCHMARK(*"
    )

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis
  method=POST "/vam/vam_visits.php"
| where match(_raw, "(?i)(union\s+(all\s+)?select|or\s+1=1|waitfor\s+delay|sleep\s*\(|benchmark\s*\()")
| table _time, src_ip, user, uri_path, uri_query, form_data, status
| sort - _time

Wazuh OSSEC Rule

<group name="web, sql_injection, cve_2023_42244,">
  <rule id="100422" level="10">
    <decoded_as>web</decoded_as>
    <match>vam_visits.php</match>
    <regex>(?i)(union\s+(all\s+)?select|or\s+1=1|waitfor\s+delay|sleep\s*\(|benchmark\s*\()</regex>
    <description>CVE-2023-42244 - Possible SQL injection attempt against Selesta VAM /vam/vam_visits.php</description>
    <group>attack,sql_injection,cve_2023_42244,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED: no vendor advisory, patch commit, or distribution channel has published a fix for CVE-2023-42244. The NVD description implies the defect was resolved in version 4.42.2, but that version's availability and fix content have not been verified by any tracked source. Until confirmed, treat all VAM instances as vulnerable.

1. Immediate mitigations:

   • Deploy the detection rules above on the WAF/network and log layers; block generic SQL injection signatures at the WAF for the /vam/vam_visits.php path.
   • Restrict network access to the VAM web interface to trusted administrative networks or VPN egress points. Do not expose /vam/ directly to the internet unless operationally required.
   • Apply the principle of least privilege to the database account used by the VAM web application: revoke FILE, INSERT/UPDATE/DELETE on non-essential tables, CREATE, DROP, and SHUTDOWN privileges if the DBMS account currently holds them.
   • Audit and revoke unnecessary application accounts; enforce multi-factor authentication for all VAM logins to reduce the reachability of the authenticated attack surface.

2. Patch/upgrade steps:

   • Contact Selesta or the authorized distributor to request the patched build (version 4.42.2 or later). Validate the vendor's advisory and checksums before deployment.
   • If 4.42.2 is obtained, perform the upgrade in a maintenance window with a full database backup, then run a regression test of all visitor-management workflows and a post-upgrade vulnerability scan to confirm the injection point is closed.

3. Long-term hardening:

   • Mandate secure code review and static analysis (SAST) for all web-facing PHP modules in VAM, with a focus on converting dynamic SQL to parameterized queries/prepared statements.
   • Place VAM database credentials in a managed secrets store and implement database activity monitoring to detect anomalous query patterns.
   • Integrate Selesta product versions into enterprise CVE/patch tracking so future advisories are acted on within defined SLAs.
   • Monitor FIRST EPSS and CISA KEV feeds for changes in exploitation status, and re-evaluate exposure if this CVE begins appearing in weaponized tooling.

References

• NVD — CVE-2023-42244: https://nvd.nist.gov/vuln/detail/CVE-2023-42244
• CVE.org Record: https://www.cve.org/CVERecord?id=CVE-2023-42244
• MITRE CVE List: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42244
• FIRST EPSS (CVE-2023-42244): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog: not listed at the time of writing — no CISA KEV entry exists for this CVE.

No vendor advisory, researcher publication, or confirmed in-the-wild exploitation campaign has been identified for CVE-2023-42244 at the time of writing. Organizations should rely on the detection and mitigation guidance above while awaiting an official vendor response.