External risk intelligence

webTareas SQL Injection Vulnerability in phasesets.php

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-44291

webTareas is a web-based application designed for project management and collaboration. Such applications are commonly deployed as web services, making them reachable via the public internet in standard deployment configurations.

SQL Injection

Webtareas Project Webtareas

2.4

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the webTareas application, specifically within its phasesets.php component. This flaw, if exploited, could allow unauthorized access and manipulation of sensitive data due to a SQL injection vulnerability. The primary concern is to confirm if this application is in use and if it is exposed to external networks.

Database access vulnerability in webTareas.
Critical flaw impacts data integrity and access.
Confirm use and exposure to assess risk.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a crafted request to the vulnerable web application over the network. The `id` parameter in `phasesets.php` can be manipulated to inject malicious SQL code, leading to unauthorized access and modification of sensitive data.

No authentication required.
Manipulate `id` parameter in `phasesets.php`.
Full database compromise is possible.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in the `id` parameter of `phasesets.php` could allow an unauthenticated attacker to manipulate the application's database. This could potentially lead to unauthorized access, modification, or deletion of system and user data.

System and user data.
Via network requests to the application.
Database compromise and data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in webTareas, a web-based project management application, likely impacts the application owners and the platform or infrastructure teams responsible for its deployment and availability. The initial practical step is to identify all instances of webTareas within the environment, assess their exposure and criticality, and then confirm the accountable owner to plan remediation.

Application owners should manage remediation efforts.
Verify all webTareas instances and their reachability.
Plan maintenance for risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the webTareas software?

webTareas is a web-based project management and collaboration platform. Organizations use it to track project workflows, manage team tasks, and coordinate shared work. Because it is a web application, it is typically hosted on a server and accessed through a browser.

What does CVE-2022-44291 mean?

This CVE identifies a SQL injection vulnerability, categorized as CWE-89. In simple terms, this means the software does not properly filter information entered into the system. An attacker can use this weakness to send malicious database commands instead of expected data, potentially gaining unauthorized control over the application's information.

How is this webTareas vulnerability triggered?

The flaw is triggered by sending a specially crafted network request containing malicious code through the 'id' parameter in the phasesets.php file. Importantly, this does not require an attacker to have a valid login account; the system will process the input even from an unauthenticated user.

Why should I care about this vulnerability?

You should care if your organization runs webTareas, especially on servers reachable from the public internet. According to Halo Surface Signal, this software is commonly deployed as a web service, which increases the likelihood that it is accessible to external actors who could reach the vulnerable component directly.

What should I do if I run webTareas?

Your first step is to locate all instances of webTareas in your environment. Once identified, evaluate whether those instances are accessible from the network and determine who is responsible for their maintenance. Work with your infrastructure team to prioritize these systems for remediation to protect your database integrity.

References

github.com/anhdq201/webtareas/issues/1

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.