Cisco Prime License Manager Web Framework HTTP POST Request sql injection

Summaryinfo

A vulnerability categorized as critical has been discovered in Cisco Prime License Manager. This impacts an unknown function of the component Web Framework. Such manipulation as part of HTTP POST Request leads to sql injection. This vulnerability is listed as CVE-2018-15441. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Cisco Prime License Manager (affected version unknown). It has been rated as critical. Affected by this issue is an unknown functionality of the component Web Framework. The manipulation as part of a HTTP POST Request leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the web framework code of Cisco Prime License Manager (PLM) could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation of user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted HTTP POST requests that contain malicious SQL statements to an affected application. A successful exploit could allow the attacker to modify and delete arbitrary data in the PLM database or gain shell access with the privileges of the postgres user.

The bug was discovered 11/28/2018. The weakness was presented 11/28/2018 as cisco-sa-20181128-plm-sql-inje as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is handled as CVE-2018-15441 since 08/17/2018. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 06/12/2023). The MITRE ATT&CK project declares the attack technique as T1505.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 371370 (Cisco Prime License Manager SQL Injection Vulnerability(cisco-sa-20181128-plm-sql-inject)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 106039†). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Cisco

Name

• Prime License Manager

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion