>> Cisco Unified Communication Manager "key" SQL Injection Vulnerability
Title : Cisco Unified Communication Manager "key" SQL Injection Vulnerability VUPEN ID : VUPEN/ADV-2008-0542 CVE ID : CVE-2008-0026
Rated as : Moderate Risk
Remotely Exploitable : Yes Locally Exploitable : Yes Release Date : 2008-02-14
Technical Description
A vulnerability has been identified in Cisco Unified Communication Manager, which could be exploited by authenticated attackers to manipulate SQL queries. This issue is caused by an input validation error in various admin and user interface pages when processing the "key" parameter, which could be exploited by malicious user to conduct SQL injection attacks and gain unauthorized access to sensitive information such as usernames and password hashes that are stored in the database.
