CVE-2008-0026

🗓️ 14 Feb 2008 11:00:00Reported by ciscoType

cve🔗 web.nvd.nist.gov👁 46 Views🌐 WEB

SQL injection in Cisco Unified CallManager/Communications Manager (CUCM) 5.0/5.1 and 6.0/6.

Reporter	Title	Published	Views	Family All 8
Cisco	SQL injection in Cisco Unified Communications Manager	13 Feb 200816:00	–	cisco
Cvelist	CVE-2008-0026	14 Feb 200811:00	–	cvelist
EUVD	EUVD-2008-0039	7 Oct 202500:30	–	euvd
NVD	CVE-2008-0026	14 Feb 200812:00	–	nvd
Packet Storm	CiscoCallManager_sql_07_016.txt	22 Feb 200800:00	–	packetstorm
Prion	Sql injection	14 Feb 200812:00	–	prion
securityvulns	Cisco Security Advisory: SQL injection in Cisco Unified Communications Manager	16 Feb 200800:00	–	securityvulns
seebug.org	Cisco Unified Communications Manager key参数SQL注入漏洞	20 Feb 200800:00	–	seebug

NVD

Node

cisco unified_callmanagerMatch5.0

cisco unified_callmanagerMatch5.0(1)

cisco unified_callmanagerMatch5.0(2)

cisco unified_callmanagerMatch5.0(3)

cisco unified_callmanagerMatch5.0(3a)

cisco unified_callmanagerMatch5.0(4)

cisco unified_callmanagerMatch5.0_4a

cisco unified_callmanagerMatch5.1

cisco unified_callmanagerMatch6.0

cisco unified_communications_managerMatch5.0

cisco unified_communications_managerMatch5.0_1

cisco unified_communications_managerMatch5.0_2

cisco unified_communications_managerMatch5.0_3

cisco unified_communications_managerMatch5.0_3a

cisco unified_communications_managerMatch5.0_4

cisco unified_communications_managerMatch5.0_4a

cisco unified_communications_managerMatch5.0_4a_su1

cisco unified_communications_managerMatch6.0

cisco unified_communications_managerMatch6.0_1

cisco unified_communications_managerMatch6.1

Source	Link
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/40484
securityfocus	www.securityfocus.com/bid/27775
securitytracker	www.securitytracker.com/id
cisco	www.cisco.com/en/US/products/products_security_advisory09186a0080949c7c.shtml
secunia	www.secunia.com/advisories/28932
vupen	www.vupen.com/english/advisories/2008/0542

Parameter	Position	Path	Description	CWE
reqParams	query param	ccmuser/personaladdressbookFindList.do	SQL injection point via key parameter and related POST/GET parameters in the user interface of CUCM.	CWE-89
recCnt	query param	ccmuser/personaladdressbookFindList.do	SQL injection point via key parameter and related POST/GET parameters in the user interface of CUCM.	CWE-89
colCnt	query param	ccmuser/personaladdressbookFindList.do	SQL injection point via key parameter and related POST/GET parameters in the user interface of CUCM.	CWE-89
key	query param	ccmuser/personaladdressbookFindList.do	SQL injection point via key parameter and related POST/GET parameters in the user interface of CUCM.	CWE-89
primaryTable	query param	ccmuser/personaladdressbookFindList.do	SQL injection point via key parameter and related POST/GET parameters in the user interface of CUCM.	CWE-89
dispCols	query param	ccmuser/personaladdressbookFindList.do	SQL injection point via key parameter and related POST/GET parameters in the user interface of CUCM.	CWE-89
searchField	query param	ccmuser/personaladdressbookFindList.do	SQL injection point via key parameter and related POST/GET parameters in the user interface of CUCM.	CWE-89
key	query param	ccmuser/personaladdressbookEdit.do	SQL injection point via key parameter (and access to primaryTable/dispCols) in the user/admin interface of CUCM.	CWE-89
primaryTable	query param	ccmuser/personaladdressbookEdit.do	SQL injection point via key parameter (and access to primaryTable/dispCols) in the user/admin interface of CUCM.	CWE-89
dispCols	query param	ccmuser/personaladdressbookEdit.do	SQL injection point via key parameter (and access to primaryTable/dispCols) in the user/admin interface of CUCM.	CWE-89

23 Apr 2026 00:35Current

7.8High risk

Vulners AI Score7.8

CVSS 26.5

EPSS0.00379

CWE-89