CVE-2022-36961

What it actually does

This is an authenticated SQL injection vulnerability in a server-side component. A low-privileged authenticated user can submit crafted input that is incorporated into SQL queries without sufficient parameterization or validation. Successful exploitation can allow the attacker to read or modify application database contents, alter authorization-related records, escalate privileges, and, where the database/application configuration permits dangerous database functions or command execution paths, potentially achieve remote code execution. The supplied product metadata is inconsistent with the vulnerability description, so teams should verify applicability against their deployed product and vendor advisory before scoping remediation.

Why it matters to the business

A successful attack can let an already-authenticated user take over higher-privileged application access, expose sensitive operational data, corrupt configuration or service-discovery data, and potentially gain control of the underlying application server. Although this is not listed in CISA KEV and exploit maturity is reported as none, the EPSS score is high and the issue has been public since 2022, so internet-accessible or widely used deployments should be treated as urgent, especially where untrusted users can authenticate.

How an attack unfolds

An attacker first obtains valid low-privilege credentials or reuses an existing application account. They then identify a vulnerable request parameter or API field processed by the affected component and submit SQL metacharacters or Boolean/time/error-based payloads to confirm query manipulation. After confirming injection, the attacker enumerates database structure and application tables, extracts sensitive records, or modifies records controlling roles, permissions, sessions, or configuration. If the application or database account has excessive privileges, the attacker may use database-specific features, file-write capabilities, scheduled jobs, extensions, or command-execution procedures to move from database compromise to remote code execution on the host. Because exploitation requires authentication, signs may appear as suspicious activity from otherwise legitimate accounts rather than anonymous scanning alone.

How to fix it

Upgrade or rebuild affected code to include the vendor fix. For the supplied affected package, alibaba/nacos from Git should include commit 1d88d5d773c46912957a15cb6e78bd8b01c89fde or a later trusted release containing that commit. Because the description references a different product family than the affected-product metadata, confirm the correct vendor advisory and deployed artifact before closing remediation. As compensating controls, restrict administrative and authenticated interfaces to trusted networks, enforce least-privilege database accounts, disable dangerous database features not required by the application, require strong MFA for application access, rotate credentials for potentially exposed accounts, and deploy WAF or API gateway rules to detect and block SQL injection patterns. Ensure all database access paths use parameterized queries or safe ORM bindings rather than string concatenation.

How to confirm the fix worked

Confirm the running application version or build includes the fixed commit 1d88d5d773c46912957a15cb6e78bd8b01c89fde or a later fixed release. Review software composition, container images, and deployed binaries to ensure no older vulnerable build remains. Validate that vulnerable request paths no longer alter SQL behavior when supplied with benign test payloads such as quotes, Boolean expressions, and database-specific time-delay functions; perform this only in authorized test environments. Check that the application database account cannot create files, execute OS commands, load unsafe extensions, or modify privilege-critical data outside intended application workflows. Confirm web/API logs and database audit logs are being retained and can correlate authenticated user, source IP, request path, query errors, and anomalous SQL behavior.

Typical attack path

1. Obtain or compromise a low-privileged authenticated account for the affected application.
2. Send crafted requests containing SQL control characters, Boolean expressions, UNION queries, stacked queries, or time-delay functions to vulnerable parameters.
3. Confirm SQL injection using changed responses, database errors, or measurable response delays.
4. Enumerate database version, schema names, table names, and privilege model.
5. Extract sensitive data or authentication/session material from the application database.
6. Modify authorization, user, role, or configuration records to escalate privileges inside the application.
7. If database permissions allow, invoke database features that write files, load extensions, create jobs, or execute operating-system commands.
8. Use elevated application or host access to persist, pivot, or disrupt service.

How to detect it

Investigate whether authenticated users submitted SQL injection payloads to application or API endpoints. Review web server, reverse proxy, API gateway, WAF, application, identity, and database audit logs for requests containing SQL metacharacters, UNION SELECT statements, stacked queries, SQL comments, database time-delay functions, schema enumeration terms, or database error messages. Correlate suspicious requests with successful logins, unusual source IPs, impossible travel, new user agents, repeated 4xx/5xx responses, slow responses consistent with time-based injection, and privilege changes shortly after the requests. In database logs, look for unexpected access to metadata tables, privilege tables, user/session tables, configuration tables, file-write operations, extension loading, scheduled job creation, or OS command execution procedures. On hosts, look for unexpected child processes spawned by the application or database service, new web-accessible files, modified application configuration, unauthorized administrator accounts, and persistence mechanisms created near the time of suspicious database activity.

• UNION SELECT
• UNION ALL SELECT
• information_schema
• pg_catalog
• sys.objects
• sqlite_master
• SLEEP(
• BENCHMARK(
• WAITFOR DELAY
• pg_sleep(
• DBMS_LOCK.SLEEP
• OR 1=1
• ' OR '1'='1
• " OR "1"="1
• --
• /*
• */
• ; DROP TABLE
• ; EXEC
• xp_cmdshell
• LOAD_FILE(
• INTO OUTFILE
• INTO DUMPFILE
• sqlmap
• SQL syntax
• mysql_fetch
• ORA-00933
• ORA-01756
• PostgreSQL query failed
• Microsoft OLE DB Provider for SQL Server
• ODBC SQL Server Driver
• You have an error in your SQL syntax
• 1d88d5d773c46912957a15cb6e78bd8b01c89fde

What your security team should do

• Prioritize inventory: identify all deployments matching the affected product or vendor advisory, especially internet-accessible or multi-user instances.
• Patch or rebuild affected deployments to include commit 1d88d5d773c46912957a15cb6e78bd8b01c89fde or a later fixed release after confirming product applicability.
• Treat high-EPSS exposure as urgent even though the vulnerability is not currently in CISA KEV.
• Restrict access to authenticated application/API surfaces using VPN, allowlists, zero-trust access controls, or private network placement.
• Review accounts with recent suspicious activity and rotate credentials or tokens for accounts that interacted with vulnerable endpoints.
• Enable and review database audit logging for errors, UNION queries, stacked queries, time-delay functions, schema enumeration, and privilege-table modifications.
• Harden database permissions so the application account cannot execute operating-system commands, write arbitrary files, load extensions, or perform unnecessary administrative actions.
• Deploy temporary WAF/API rules for SQL injection patterns while patching, but do not rely on filtering as the primary fix.
• Run a post-patch compromise assessment focused on privilege escalation, unauthorized user creation, altered roles, unexpected configuration changes, and suspicious database artifacts.
• Resolve the metadata discrepancy between the described product and affected product in internal tracking to avoid false positives or missed assets.