CVE:CVE-2011-1610
CNNVD:CNNVD-201104-326
Cisco Unified Communications Manager是企业级IP电话呼叫处理系统。
Cisco Unified Communications Manager的嵌入式Apache HTTP服务器组件中的xmldirectorylist.jsp中存在多个SQL注入漏洞。远程攻击者可以借助(1)f，(2)l，或(3)n参数执行任意SQL命令，导致控制受影响设备。
solution:Upgrade cisco unified_communications_manager to a higher version than 6.0,6.1(1,6.1(1a,6.1(1b,6.1(2,6.1(2su1,6.1(2su1a,6.1(3,6.1(3a,6.1(3b,6.1(3bsu1,6.1(4,6.1(4su1,6.1(4a,6.1(4asu2,6.1(5,6.1(5su1,6.1(5su2,7.0(1su1,7.0(1su1a,7.0(2,7.0(2a,7.0(2asu1,7.0(2asu2,7.1(2a,7.1(2asu1,7.1(2b,7.1(2bsu1,7.1(3,7.1(3a,7.1(3asu1,7.1(3asu1a,7.1(3b,7.1(3bsu1,7.1(3bsu2,7.1(5,7.1(5su1,7.1(5su1a,7.1(5a,7.1(5b,7.1(5bsu2,7.1(5bsu3,8.0,8.0(2c,8.0(2csu1,8.0(3,8.0(3a,8.0(3asu1,and avoid the version 6.0,6.1(1),6.1(1a),6.1(1b),6.1(2),6.1(2)su1,6.1(2)su1a,6.1(3),6.1(3a),6.1(3b),6.1(3b)su1,6.1(4),6.1(4)su1,6.1(4a),6.1(4a)su2,6.1(5),6.1(5)su1,6.1(5)su2,7.0(1)su1,7.0(1)su1a,7.0(2),7.0(2a),7.0(2a)su1,7.0(2a)su2,7.1(2a),7.1(2a)su1,7.1(2b),7.1(2b)su1,7.1(3),7.1(3a),7.1(3a)su1,7.1(3a)su1a,7.1(3b),7.1(3b)su1,7.1(3b)su2,7.1(5),7.1(5)su1,7.1(5)su1a,7.1(5a),7.1(5b),7.1(5b)su2,7.1(5b)su3,8.0,8.0(2c),8.0(2c)su1,8.0(3),8.0(3a),8.0(3a)su1