CVE-2016-1914: Multiple SQL injection vulnerabilities in the com.rim.mdm.ui.server.ImageServlet servlet in BlackBerry Enterprise Server 12 (BES12) Self-Service before 12.4…

PriorityP263high8.8CVSS 3.0

AVNACLPRNUIRSUCHIHAH

EXPLOIT

EPSS

4.10%

89.5th percentile

Multiple SQL injection vulnerabilities in the com.rim.mdm.ui.server.ImageServlet servlet in BlackBerry Enterprise Server 12 (BES12) Self-Service before 12.4 allow remote attackers to execute arbitrary SQL commands via the imageName parameter to (1) mydevice/client/image, (2) admin/client/image, (3) myapps/client/image, (4) ssam/client/image, or (5) all/client/image.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
blackberry	blackberry_enterprise_service	<= 12.3.1	—

Detection & IOCsextracted from sources · hover to see the quote

url/mydevice/client/image?imageName=ui.cobranded.login.logo'+UNION+ALL+SELECT+NULL,NULL,NULL,NULL,NULL,(SELECT+*+FROM+obj_keystore_entry+FOR+XML+PATH(''))+--↗

path/mydevice/client/image↗

path/admin/client/image↗

path/myapps/client/image↗

path/ssam/client/image↗

path/all/client/image↗

→Monitor HTTP requests to the ImageServlet paths (/mydevice/client/image, /admin/client/image, /myapps/client/image, /ssam/client/image, /all/client/image) for SQL injection patterns in the 'imageName' parameter, particularly UNION SELECT payloads and SQL comment sequences (e.g., '--'). ↗
→Look for UNION-based SQL injection payloads targeting BES12 database tables: obj_keystore_entry, obj_user, obj_user_authentication, and obj_user_device — these contain credentials, auth tokens, enrolment tokens, and device encryption keys. ↗
→Detect XSS attempts via the 'locale' parameter on /mydevice/index.jsp and /mydevice/loggedOut.jsp; look for script injection patterns such as ">alert( in the parameter value. ↗
→Note that the application uses the HttpOnly cookie flag for session tokens, so XSS exploitation will not directly steal cookies but can perform in-application actions on behalf of the victim, including against the admin interface if hosted on the same domain. ↗

·The SQL injection is exploitable without authentication by remote attackers, as no authentication requirement is mentioned for the ImageServlet endpoint. ↗
·The XSS and SQL injection impact on the administrative interface is deployment-specific — the admin web application is only co-attackable via XSS if it is hosted on the same domain as the self-service portal. ↗

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.