CVE-2018-0120

A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct an SQL injection attack against an affected system. The vulnerability exists because the affected software fails to validate user-supplied input in certain SQL queries that bypass protection filters. An attacker could exploit this vulnerability by submitting crafted HTTP requests that contain malicious SQL statements to an affected system. A successful exploit could allow the attacker to determine the presence of certain values in the database of the affected system. Cisco Bug IDs: CSCvg74810.

• CWE-89
• CWE-89

• http://www.securityfocus.com/bid/102958Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040341Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-cucmVendor Advisory
• http://www.securityfocus.com/bid/102958Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040341Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-cucmVendor Advisory

Published

Feb 8, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-0114A vulnerability in the Cisco node-jose open source library b…7.5
• CVE-2018-0115A vulnerability in the CLI of the Cisco StarOS operating sys…
• CVE-2018-0116A vulnerability in the RADIUS authentication module of Cisco…
• CVE-2018-0117A vulnerability in the ingress packet processing functionali…
• CVE-2018-0118A vulnerability in the web-based management interface of Cis…
• CVE-2018-0119A vulnerability in certain authentication controls in the ac…
• CVE-2018-0121A vulnerability in the authentication functionality of the w…
• CVE-2018-0122A vulnerability in the CLI of the Cisco StarOS operating sys…4.4
• CVE-2018-0123A Path Traversal vulnerability in the diagnostic shell for C…
• CVE-2018-0124A vulnerability in Cisco Unified Communications Domain Manag…
• CVE-2018-0125A vulnerability in the web interface of the Cisco RV132W ADS…9.8
• CVE-2018-0127A vulnerability in the web interface of Cisco RV132W ADSL2+ …9.8