PT-2008-1689 · Cisco · Cisco Unified Callmanager/Communications Manager

Published 2008-02-14 · Updated 2017-08-08 · CVE-2008-0026

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Unified CallManager/Communications Manager (CUCM) versions 5.0 through 5.1(3a) and versions 6.0 through 6.1(1a)

Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the key parameter to the admin and user interface pages, specifically the "(1) admin and (2) user interface pages".

Recommendations For versions 5.0 through 5.1(3a), update to version 5.1(3a) or later. For versions 6.0 through 6.1(1a), update to version 6.1(1a) or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-0026

Affected Products

Cisco Unified Callmanager/Communications Manager

References · 8

• 🔥 https://exploit-db.com/exploits/31189 · Exploit
• http://secunia.com/advisories/28932 · Vendor Advisory
• http://cisco.com/en/US/products/products_security_advisory09186a0080949c7c.shtml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0026 · Security Note
• http://vupen.com/english/advisories/2008/0542 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/40484 · Note
• http://securitytracker.com/id?1019404 · Note
• http://securityfocus.com/bid/27775 · Note