CVE-2018-9102 SQL injection in n/a

Medium 6.5 Published 25 Apr 2018 Updated 5 Aug 2024

Unauthenticated attackers can perform SQL injection via the signin interface to extract sensitive database information from Mitel MiVoice Connect.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2018-9102?

CVE-2018-9102 is a medium-severity SQL injection vulnerability in n/a, published on 25 Apr 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the signin interface. A successful exploit could allow an attacker to extract sensitive information from the database.

Weakness: CWE-89

Which versions are affected by CVE-2018-9102?

It affects 2 products.

Products include Mitel Mivoice Connect, Mitel St 14.2.

How do I fix CVE-2018-9102?

No fix has been published for CVE-2018-9102 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2018-9102 being exploited?

There is no known exploitation of CVE-2018-9102 in the wild and no public exploit code.

Sources

Also known as GHSA-67v2-whp9-7jrx.