PT-2021-23599 · Imagicle · Imagicle Application Suite

Dawid Czarnecki · Published 2021-10-14 · Updated 2023-09-28 · CVE-2021-42369

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N

Name of the Vulnerable Software and Affected Versions Imagicle Application Suite (for Cisco UC) versions prior to 2021.Summer.2

Description The issue allows SQL injection, where a low-privileged user could inject a SQL statement through the "Export to CSV" feature of the Contact Manager web GUI.

Recommendations For versions prior to 2021.Summer.2, update to version 2021.Summer.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the "Export to CSV" feature of the Contact Manager web GUI to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-42369

Affected Products

Imagicle Application Suite

References · 6

• 🔥 https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/Imagicle/CVE · Exploit
• https://imagicle.com/en/resources/download · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42369 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42369 · Vendor Advisory
• https://t.me/cibsecurity/30593 · Telegram Post
• https://zigrin.com/advisories/imagicle-sql-injection-vulnerability-in-contacts-csv-export · Note