Imagicle – SQL injection vulnerability in contacts CSV export
Update to Imagicle version 2021.Summer.2
Imagicle Application Suite for Cisco UC from version 2014.Winter.1 is vulnerable to SQL injection. A malicious low-privileged authenticated user could inject an SQL statement to the database through the “Export to CSV” of the Contact Manager web GUI. This could lead to disclosure of local administrator’s password, which subsequently could be used to modify the application or make it nonfunctional.
Do you think the security of your data might be lacking? Let's find the best approach together.
Once you contact us, we will ask you about the project you want to secure.