CVE-2018-15441 Cisco Prime License Manager SQL Injection Vulnerability
CriticalCVSS 9.8
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A vulnerability in the web framework code of Cisco Prime License Manager (PLM) could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation of user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted HTTP POST requests that contain malicious SQL statements to an affected application. A successful exploit could allow the attacker to modify and delete arbitrary data in the PLM database or gain shell access with the privileges of the postgres user.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco prime license manager | >= 11.0.1, <= 11.5 | No fix listed |
| cisco prime license manager | = 11.5(1)-su5 | No fix listed |
| Cisco Prime License Manager | All versions | No fix listed |
References
- 106039 third-party-advisory vdb-entry
- 20181128 Cisco Prime License Manager SQL Injection Vulnerability vendor-advisory