ACM (SQL Injection) (SQL Injection)

Successful exploitation of CVE-2019-7003 could grant an attacker complete control over the Avaya Control Manager database. This includes the ability to read, modify, or delete sensitive user data, configuration settings, and potentially even system credentials. The lack of authentication required for exploitation significantly broadens the attack surface, making it accessible to a wide range of threat actors. An attacker could leverage this access to perform reconnaissance, escalate privileges, and potentially pivot to other systems within the network. The blast radius extends to any data stored within the Avaya Control Manager database, which could include personally identifiable information (PII) and confidential business data.

Organizations utilizing Avaya Control Manager in environments with direct external access to the reporting component are at significant risk. Specifically, deployments with weak network segmentation or inadequate input validation are particularly vulnerable. Shared hosting environments where multiple customers share the same Avaya Control Manager instance also face increased exposure.

• linux / server:

journalctl -u avaya-control-manager -g 'SQL injection' | grep -i error

• generic web:

curl -I <avaya_control_manager_reporting_endpoint> | grep SQL

• database (mysql):

SELECT user, password FROM mysql.user WHERE user LIKE '%admin%';

1. 2019-07-11Disclosure

   disclosure

1. Reserviert2019-01-28
2. Veröffentlicht2019-07-11
3. Geändert2024-09-17
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2019-7003 is to immediately upgrade Avaya Control Manager to version 8.0.4.0 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting network access to the reporting component and implementing strict input validation on all user-supplied data. While not a complete solution, a Web Application Firewall (WAF) configured to detect and block SQL injection attempts can provide an additional layer of defense. Monitor Avaya Control Manager logs for suspicious SQL queries or unusual database activity. After upgrading, verify the fix by attempting a SQL injection attack on the reporting component; it should be blocked.