Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerability

Bugtraq ID:	99214
Class:	Input Validation Error
CVE:	CVE-2017-6698
Remote:	Yes
Local:	No
Published:	Jun 22 2017 12:00AM
Updated:	Jun 22 2017 12:00AM
Credit:	Pichaya Morimoto
Vulnerable:	Cisco Prime Infrastructure 3.1(1) Cisco Prime Infrastructure - Cisco Network Level Service 2.0(4.0.45B) Cisco Evolved Programmable Network Manager 0
Not Vulnerable:

Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerability

Cisco Prime Infrastructure and Evolved Programmable Network Manager are prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.

An attacker can leverage this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue is tracked by Cisco Bug ID's CSCvc23892, CSCvc35270, CSCvc35626, CSCvc35630 and CSCvc49568.

Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerability

References:

• Cisco Homepage (Cisco)
  
• cisco-sa-20170621-piepnm2: Cisco Prime Infrastructure and Evolved Programmable N (Cisco)