CyberRota Analysis
AI-GeneratedAn unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 allows remote attackers to manipulate PostgreSQL queries by injecting malicious PhoneIP values through the /pa endpoint. This can lead to unauthorized database operations and potential remote code execution. Organizations using this version of Switchvox should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.