SQL injection in Asterisk Open Source and Certified Asterisk - CVE-2022-26651
Published: April 19, 2022
Vulnerability identifier: #VU62391
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-26651
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data in func_odbc module. A remote non-attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
Affected software
Asterisk Open Source
Certified Asterisk
Debian Linux
asterisk (Debian package)
Certified Asterisk
Debian Linux
asterisk (Debian package)
How to mitigate CVE-2022-26651
Install update from vendor's website.
Asterisk Open Source - addressed in versions 16.25.2, 18.11.2, 19.3.2
Certified Asterisk - update to 16.8-cert14
asterisk (Debian package) - update to 1:16.28.0~dfsg-0+deb11u1
Certified Asterisk - update to 16.8-cert14
asterisk (Debian package) - update to 1:16.28.0~dfsg-0+deb11u1