Cisco Unified Communications Manager Interactive Voice Response Interface SQL Injection Vulnerability

A vulnerability in the Interactive Voice Response (IVR) interface of Cisco Unified Communications Manager (UCM) could allow an unauthenticated, remote attacker to conduct SQL injection attacks.

The vulnerability is due to a lack of input validation on user-supplied input within SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected system. A successful exploit could allow the attacker to determine the presence of certain values in the database, which could be leveraged to conduct further attacks.

Cisco has confirmed the vulnerability; however, software updates are not available.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.