Cisco Unified Communications Manager IP Manager Assistant Interface SQL Injection Vulnerability

Bugtraq ID:	65514
Class:	Input Validation Error
CVE:	CVE-2014-0726
Remote:	Yes
Local:	No
Published:	Feb 12 2014 12:00AM
Updated:	Feb 12 2014 12:00AM
Credit:	Cisco
Vulnerable:
Not Vulnerable:

Cisco Unified Communications Manager IP Manager Assistant Interface SQL Injection Vulnerability

Cisco Unified Communications Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an authenticated attacker to compromise the affected application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue is tracked by Cisco Bug ID CSCum05326.

Cisco Unified Communications Manager IP Manager Assistant Interface SQL Injection Vulnerability

An attacker can exploit this issue using some readily available tools.

Cisco Unified Communications Manager IP Manager Assistant Interface SQL Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cisco Unified Communications Manager IP Manager Assistant Interface SQL Injection Vulnerability

References:

• Cisco Homepage (Cisco)