Cisco Unified Communications Manager CMIVR Interface SQL Injection Vulnerability
BID:65516
Info
Cisco Unified Communications Manager CMIVR Interface SQL Injection Vulnerability
| Bugtraq ID: | 65516 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-0727 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 12 2014 12:00AM |
| Updated: | Feb 12 2014 12:00AM |
| Credit: | Cisco |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Cisco Unified Communications Manager CMIVR Interface SQL Injection Vulnerability
Cisco Unified Communications Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
A successful exploit may allow an authenticated attacker to compromise the affected application, access or modify data, or exploit latent vulnerabilities in the underlying database.
This issue is tracked by Cisco Bug ID CSCum05318.
Cisco Unified Communications Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
A successful exploit may allow an authenticated attacker to compromise the affected application, access or modify data, or exploit latent vulnerabilities in the underlying database.
This issue is tracked by Cisco Bug ID CSCum05318.
Exploit / POC
Cisco Unified Communications Manager CMIVR Interface SQL Injection Vulnerability
An attacker can exploit this issue using some readily available tools.
An attacker can exploit this issue using some readily available tools.
References
Cisco Unified Communications Manager CMIVR Interface SQL Injection Vulnerability
References:
References:
- Cisco Homepage (Cisco)