CVE-2022-21234

What it actually does

This is an authenticated SQL injection vulnerability in the Lansweeper web application, specifically in the EchoAssets.aspx functionality. Because attacker-controlled input is incorporated into SQL queries without sufficient validation or parameterization, a low-privileged authenticated user can send a crafted HTTP request that alters the intended database query. Successful exploitation can allow unauthorized database reads, modification or deletion of data, and potentially actions that affect application availability, depending on database permissions and deployment configuration. The CVSS 8.8 rating reflects network exploitability, low attack complexity, no user interaction, and high potential impact to confidentiality, integrity, and availability.

Why it matters to the business

A compromised Lansweeper deployment can expose sensitive IT asset inventory data, credentials or configuration details stored in the application database, and operational information useful for follow-on attacks. Because Lansweeper commonly contains broad visibility into endpoints, servers, software, users, and network assets, database compromise can materially increase an attacker's ability to plan lateral movement and prioritize high-value systems. The high EPSS score and public exploit availability increase urgency even though this CVE is not currently listed in CISA KEV.

How an attack unfolds

An attacker first obtains valid credentials for the Lansweeper web interface, such as through phishing, credential reuse, password spraying, or compromise of a low-privileged account. The attacker then sends a crafted HTTP request to the EchoAssets.aspx endpoint containing SQL syntax in a vulnerable parameter. If the application passes that input into a backend SQL query unsafely, the database interprets attacker-supplied SQL instead of treating it as data. The attacker may begin with error-based or boolean/time-based probes to confirm injection, then enumerate database structure, extract sensitive records, alter application data, or perform destructive queries. In a broader intrusion, the stolen asset inventory and configuration data can be used to identify privileged systems, vulnerable software, domain infrastructure, and paths for lateral movement.

How to fix it

Upgrade Lansweeper to a vendor-supported version that contains the fix for this vulnerability. No exact fixed version was provided in the input, so administrators should consult Lansweeper's official security advisory and release notes for CVE-2022-21234 and apply the earliest fixed or latest supported release. If immediate upgrade is not possible, restrict access to the Lansweeper web interface to trusted administrative networks or VPNs, enforce strong authentication and least-privilege roles, review and disable unnecessary accounts, and monitor or block suspicious requests to EchoAssets.aspx containing SQL metacharacters or database function calls. Do not rely on web application firewall rules as the only mitigation; the durable fix is applying the vendor patch that removes the unsafe query construction.

How to confirm the fix worked

Confirm the running Lansweeper version is newer than the vulnerable 9.1.20.2 release and matches a vendor-supported fixed release. Validate that EchoAssets.aspx remains reachable only to authorized users and trusted network locations. Review application and web server logs to ensure no current requests to EchoAssets.aspx are returning SQL errors or abnormal response codes. If approved in a controlled test environment, perform a non-destructive authenticated SQL injection validation using safe payloads and confirm the application treats input as data rather than altering query behavior. Also verify that database permissions used by the application are least-privileged and cannot perform unnecessary administrative operations.

Typical attack path

1. Acquire or reuse valid Lansweeper web application credentials.
2. Access the Lansweeper web interface over the network.
3. Send crafted HTTP requests to the EchoAssets.aspx functionality with SQL injection payloads in vulnerable input.
4. Confirm exploitability through SQL errors, response differences, or timing behavior.
5. Enumerate database metadata and application tables accessible to the Lansweeper database user.
6. Extract or modify sensitive asset, user, software, configuration, or credential-related data.
7. Use the recovered IT inventory and operational data to support follow-on intrusion activity such as lateral movement, privilege escalation, or targeted exploitation.

How to detect it

To determine whether exploitation already occurred, review web server logs, reverse proxy logs, WAF logs, Lansweeper application logs, authentication logs, and database logs for authenticated requests to EchoAssets.aspx containing SQL injection syntax. Focus on requests with characters and keywords such as single quotes, double hyphens, semicolons, UNION SELECT, OR 1=1, WAITFOR DELAY, SLEEP, xp_cmdshell, information_schema, or heavily URL-encoded equivalents. Correlate suspicious requests with successful logins, unusual source IPs, new or rarely used user accounts, spikes in HTTP 500 responses, SQL exception messages, long-running requests, abnormal database errors, and large or unusual data retrieval activity. If database auditing is enabled, search for unexpected SELECTs against metadata tables, attempts to enumerate schema, use of time-delay functions, failed syntax near injected strings, or data modification statements issued by the Lansweeper application account outside normal application behavior. Because exploitation requires authentication, pay special attention to account compromise indicators around the same timeframe, including impossible travel, password spraying, repeated failed logins followed by success, and access from unfamiliar networks.

• /EchoAssets.aspx
• EchoAssets.aspx
• UNION SELECT
• UNION%20SELECT
• OR 1=1
• OR%201%3D1
• ' OR '1'='1
• %27%20OR%20%271%27%3D%271
• --
• %2D%2D
• ;--
• %3B%2D%2D
• WAITFOR DELAY
• WAITFOR%20DELAY
• SLEEP(
• SLEEP%28
• BENCHMARK(
• BENCHMARK%28
• information_schema
• INFORMATION_SCHEMA
• sys.objects
• sys.tables
• xp_cmdshell
• SQL syntax
• SqlException
• Incorrect syntax near
• Unclosed quotation mark after the character string
• The multi-part identifier could not be bound
• Conversion failed when converting
• Microsoft OLE DB Provider for SQL Server
• System.Data.SqlClient

What your security team should do

• Prioritize patching or upgrading Lansweeper because the vulnerability has public exploit availability and a high EPSS likelihood score.
• Inventory all externally and internally reachable Lansweeper web interfaces and restrict access to trusted administrative networks.
• Review Lansweeper user accounts for unnecessary, stale, shared, or weakly protected credentials; enforce MFA where supported.
• Hunt historical web and application logs for suspicious requests to EchoAssets.aspx, especially requests containing SQL syntax, comment markers, UNION queries, time-delay functions, or abnormal encoded payloads.
• Investigate any SQL errors, unusual database query failures, large data exports, or abnormal web sessions associated with low-privileged accounts.
• Rotate credentials or secrets stored in or accessible through Lansweeper if exploitation is suspected.
• Ensure backups of the Lansweeper database exist and are recoverable in case of data manipulation or destructive queries.
• Add SIEM detections for SQL injection patterns targeting Lansweeper paths and alert on anomalous authenticated access to EchoAssets.aspx.