Grandstream UCM6204 up to 1.0.19 API /cgi? listCodeblueGroup sord sql injection

Summaryinfo

A vulnerability was found in Grandstream UCM6204 up to 1.0.19. It has been rated as critical. Impacted is the function listCodeblueGroup of the file /cgi? of the component API. This manipulation of the argument sord as part of Parameter causes sql injection. This vulnerability appears as CVE-2019-10663. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in Grandstream UCM6204 up to 1.0.19. Affected by this vulnerability is the function listCodeblueGroup of the file /cgi? of the component API. The manipulation of the argument sord as part of a Parameter leads to a sql injection vulnerability. The CWE definition for the vulnerability is CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to conduct SQL injection attacks via the sord parameter in a listCodeblueGroup API call to the /cgi? URI.

The bug was discovered 03/22/2019. The weakness was presented 03/30/2019. This vulnerability is known as CVE-2019-10663 since 03/30/2019. The attack can be launched remotely. The successful exploitation requires a single authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1505 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 8 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 1.0.19.20 eliminates this vulnerability.

See VDB-132642 for similar entry. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Grandstream

Name

• UCM6204

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13
• 1.0.14
• 1.0.15
• 1.0.16
• 1.0.17
• 1.0.18
• 1.0.19

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion