The login.jsp page of Quicklert for Digium 10.0.0 (1043) is affected by both Blind SQL Injection with Out-of-Band Interaction (DNS) and Blind Time-Based SQL Injections. Exploitation can be used to disclose all data within the database (up to and including the administrative accounts' login IDs and passwords) via the login.jsp uname parameter.
References
| Link | Resource |
|---|---|
| https://quicklert.com | Vendor Advisory |
| https://www.assurainc.com/assura-announces-discovery-of-two-vulnerabilities-in-quicklert-for-digium-switchvox/amp-on/ | Exploit Third Party Advisory |
| https://quicklert.com | Vendor Advisory |
| https://www.assurainc.com/assura-announces-discovery-of-two-vulnerabilities-in-quicklert-for-digium-switchvox/amp-on/ | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 06:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://quicklert.com - Vendor Advisory | |
| References | () https://www.assurainc.com/assura-announces-discovery-of-two-vulnerabilities-in-quicklert-for-digium-switchvox/amp-on/ - Exploit, Third Party Advisory |
15 Mar 2022, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://quicklert.com - Vendor Advisory | |
| References | (MISC) https://www.assurainc.com/assura-announces-discovery-of-two-vulnerabilities-in-quicklert-for-digium-switchvox/amp-on/ - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 7.8
v3 : 6.5 |
| CWE | CWE-89 | |
| CPE | cpe:2.3:a:quicklert:quicklert:10.0.0:-:*:*:*:*:digium_switchvox:* |
10 Mar 2022, 17:54
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-03-10 17:44
Updated : 2024-11-21 06:30
NVD link : CVE-2021-43969
Mitre link : CVE-2021-43969
CVE.ORG link : CVE-2021-43969
JSON object : View
Products Affected
quicklert
- quicklert
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')