Cisco SD-WAN Solution vManage SQL Injection Vulnerability

A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web UI improperly validates SQL values. An attacker could exploit this vulnerability by authenticating to the application and sending malicious SQL queries to an affected system. A successful exploit could allow the attacker to modify values on, or return values from, the underlying database as well as the operating system.

N/A

在命令中使用的特殊元素转义处理不恰当(命令注入)

Cisco SD-WAN Solution vManage SQL注入漏洞

Cisco SD-WAN Solution是美国思科（Cisco）公司的一套网络扩展解决方案。vManage是一套网络管理系统。 Cisco SD-WAN Solution vManage Release 19.2.2之前版本中的Web UI存在SQL注入漏洞，该漏洞源于Web UI没有正确验证SQL值。远程攻击者可通过进行身份验证并发送恶意的SQL值利用该漏洞修改底层数据库和操作系统上的值或返回值。

N/A

N/A