Description

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to read the contents of the internal database of an affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T17:18:40.563Z",
  "pubdate": "2026-08-19T17:18:40.563Z",
  "executiveSummary": "A blind SQL injection vulnerability exists in the web-based management interface of Cisco Unified Intelligence Center. This security flaw stems from the insufficient validation of user-supplied input handled by the application before interacting with the backend database. An authenticated local attacker possessing valid user credentials can exploit this vulnerability by submitting specially crafted HTTP requests to the vulnerable web-based management interface. Successful exploitation of this vulnerability allows the attacker to execute arbitrary SQL queries against the underlying database, leading to the unauthorized extraction and disclosure of sensitive internal database contents. The risk implication involves the potential compromise of confidential data stored within the affected device. While network access to the web-based management interface is required, the primary prerequisites for a successful attack include authenticated access with valid user credentials and local positioning relative to the administrative mechanisms or network segment hosting the interface. The attack vector specifically targets the input handling mechanisms of the management console, bypassing proper parameterization and sanitization controls.",
  "technicalDetails": "The root cause of the vulnerability resides in the insufficient validation and sanitization of user-supplied input parameters processed by the web-based management interface of Cisco Unified Intelligence Center. When an authenticated user interacts with the management console, specific input fields fail to properly enforce strict type checking, input length constraints, or parameterized query construction. This architectural weakness allows malicious SQL syntax to be injected directly into database query strings executed by the backend database management system.\nExploitation of this vulnerability requires the attacker to possess valid user credentials for the affected device and network access to the web-based management interface. The attack flow begins when the authenticated attacker crafts a malicious HTTP request containing SQL injection payloads embedded within parameters accepted by the web interface. Upon receiving the request, the vulnerable component passes the unsanitized input directly into dynamic SQL queries without adequate abstraction or parameterization.\nBecause the vulnerability manifests as a blind SQL injection vector, the application may not directly reflect database error messages or query results in the HTTP response. Instead, the attacker relies on boolean-based or time-based inference techniques to systematically extract data. By observing application behavior, response times, or conditional error states resulting from the crafted database queries, the attacker can deduce the structure and contents of the internal database step-by-step.\nThe affected component is the web-based management interface responsible for handling administrative queries and configuration parameters within Cisco Unified Intelligence Center. The post-exploitation impact includes the total breach of confidentiality regarding stored internal data, as the attacker is capable of reading arbitrary tables and records contained within the database. The vulnerability requires authentication and local access semantics as defined by the privilege model of the target system, highlighting the necessity of robust input validation and defensive coding practices across all administrative interfaces."
}