SQL Injection in Cisco Unified Callmanager
CVE-2008-0026
SQL injection vulnerability in Cisco Unified CallManager/Communications Manager (CUCM) 5.0/5.1 before 5.1(3a) and 6.0/6.1 before 6.1(1a) allows remote authenticated users to execute arbitrary SQL commands via the key parameter to the (1) admin and (2) user interface pages.
Vulnerability class: SQL Injection
EPSS: 0.019 (78.8th percentile) — read the EPSS interpretation.
Affected products
- Cisco Unified_callmanager — versions 5.0(3a), 5.0\(3\), 5.0(3)
- Cisco Unified_communications_manager — versions 5.0, 5.0_1, 5.0_2
- N/a — versions n/a
Weakness classification (CWE)
References
- psirt@cisco.com (vdb-entry, x_refsource_BID)
- psirt@cisco.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- psirt@cisco.com (vdb-entry, x_refsource_XF)
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory)
- psirt@cisco.com (vdb-entry, x_refsource_SECTRACK)
- psirt@cisco.com (vdb-entry, x_refsource_VUPEN, Vendor Advisory)