CVE-2023-42244
Published: 13 January 2025
Description
An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vam_visits.php.
Security Summary
CVE-2023-42244 is a SQL injection vulnerability (CWE-89) discovered in Selesta Visual Access Manager (VAM) versions prior to 4.42.2. The flaw exists in multiple POST parameters of the /vam/vam_visits.php endpoint, allowing improper handling of user-supplied input that leads to injectable SQL queries.
An authenticated attacker with low privileges can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Successful exploitation grants high-impact confidentiality, integrity, and availability effects (CVSS 8.8), potentially enabling data exfiltration, modification, or deletion within the application's database.
The vulnerability was published on 2025-01-13, with a reference in a CVE list at https://gitlab.com/daniele_m/cve-list/-/blob/main/README.md. Mitigation involves updating to Selesta VAM version 4.42.2 or later, as the issue affects prior releases.
Details
- CWE(s)