CVE-2008-6573: SQL Injection
First published: Wed Apr 01 2009(Updated: )
Multiple SQL injection vulnerabilities in Avaya SIP Enablement Services (SES) in Avaya Avaya Communication Manager 3.x, 4.0, and 5.0 (1) allow remote attackers to execute arbitrary SQL commands via unspecified vectors related to profiles in the SIP Personal Information Manager (SPIM) in the web interface; and allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to (2) permissions for SPIM profiles in the web interface and (3) a crafted SIP request to the SIP server.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Avaya Communication Manager | =5.0 | |
| Avaya Communication Manager | =3.1.4 | |
| Avaya Communication Manager | =3.1.2 | |
| Avaya Communication Manager | =3.1.5-sp0 | |
| Avaya Communication Manager | =3.1.4-sp1 | |
| Avaya Communication Manager | =3.1.1 | |
| Avaya Communication Manager | =3.1.4-sp2 | |
| Avaya Communication Manager | =3.1.5 | |
| Avaya Communication Manager | =4.0 | |
| Avaya Communication Manager | <=3.1 | |
| Avaya Communication Manager | =3.1.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/28682
- http://www.voipshield.com/research-details.php?id=26
- http://support.avaya.com/elmodocs2/security/ASA-2008-150.htm
- http://secunia.com/advisories/29744
- http://support.avaya.com/elmodocs2/security/ASA-2008-151.htm
- http://www.voipshield.com/research-details.php?id=25
- http://www.voipshield.com/research-details.php?id=22
- http://osvdb.org/44285
- http://osvdb.org/44284
- http://osvdb.org/44286
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41733
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41730
- collector/nvd-historical
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/author
- agent/references
- agent/type
- agent/event
- agent/description
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/avaya
- canonical/avaya communication manager
- version/avaya communication manager/5.0
- version/avaya communication manager/3.1.4
- version/avaya communication manager/3.1.2
- version/avaya communication manager/3.1.5-sp0
- version/avaya communication manager/3.1.4-sp1
- version/avaya communication manager/3.1.1
- version/avaya communication manager/3.1.4-sp2
- version/avaya communication manager/3.1.5
- version/avaya communication manager/4.0
- version/avaya communication manager/3.1
- version/avaya communication manager/3.1.3