cbcvebase.
CVE-2011-1609
published 2011-05-03

CVE-2011-1609: SQL injection vulnerability in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su2, 7.x before 7.1(5)su1, 8.0 before…

PriorityP261high8.5CVSS 2.0
AVNACMAuSCCICAC
EXPLOIT
EPSS
19.76%
97.1th percentile
SQL injection vulnerability in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su2, 7.x before 7.1(5)su1, 8.0 before 8.0(3), and 8.5 before 8.5(1) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtg85647.

Affected

46 ranges· showing 25
VendorProductVersion rangeFixed in
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——
ciscounified_communications_manager——

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://www.example.com/ccmcip/xmldirectorylist.jsp?f=vsr'||0/1%20OR%201=1))%20--↗
urlhttp://www.example.com/ccmcip/xmldirectorylist.jsp?f=vsr'||1/0%20OR%201=1))%20--↗
path/ccmcip/xmldirectorylist.jsp
snort
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Cisco Unified Communications Manager xmldirectorylist.jsp SQL Injection Attempt"; flow:established,to_server; http.uri; content:"/ccmcip/xmldirectorylist.jsp?f=vsr|27 7C 7C|"; nocase; pcre:"/f\x3Dvsr\x27\x7C\x7C.+(or|and|select|delete|union|delete|update|insert)/i"; reference:url,www.cisco.com/en/US/products/products_security_advisory09186a0080b79904.shtml; reference:bid,47607; reference:cve,2011-1609; classtype:web-application-attack; sid:2012760; rev:5; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2011_05_03, cve CVE_2011_1609, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
  • →SQL injection payloads target the 'f' parameter of xmldirectorylist.jsp using Oracle-style boolean-based blind injection with pipe concatenation (||) and divide-by-zero error triggering (1/0). ↗
  • →Snort/Suricata detection: match HTTP URI containing '/ccmcip/xmldirectorylist.jsp?f=vsr' followed by URL-encoded pipe characters (|27 7C 7C|), then PCRE for SQL keywords (or, and, select, delete, union, update, insert).
  • →Exploitation requires an authenticated session; unauthenticated access to the vulnerable endpoint is not sufficient to trigger the SQL injection. ↗
  • →The vulnerability is tracked under Cisco Bug ID CSCtg85647; correlate IDS/SIEM alerts with this identifier for triage. ↗
  • ·Affected versions are CUCM 6.x before 6.1(5)su2, 7.x before 7.1(5)su1, 8.0 before 8.0(3), and 8.5 before 8.5(1); detections should be scoped to hosts running these versions. ↗
  • ·No workaround exists for the SQL injection vulnerabilities; only the SIP DoS vulnerabilities have a documented workaround. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.