A SQL Injection in the custom filter query component in Genesys intelligent Workload Distribution (IWD) 9.0.017.07 allows an attacker to execute arbitrary SQL queries via the value attribute, with which all data in the database can be extracted and OS command execution is possible depending on the permissions and/or database engine.
References
| Link | Resource |
|---|---|
| https://docs.genesys.com/Documentation/IWD | Product Release Notes Vendor Advisory |
| https://www.offensity.com/en/blog/authenticated-sql-injection-in-the-genesys-iwd-manager-cve-2021-40860-and-cve-2021-40861/ | Exploit Patch Third Party Advisory |
| https://docs.genesys.com/Documentation/IWD | Product Release Notes Vendor Advisory |
| https://www.offensity.com/en/blog/authenticated-sql-injection-in-the-genesys-iwd-manager-cve-2021-40860-and-cve-2021-40861/ | Exploit Patch Third Party Advisory |
Configurations
History
21 Nov 2024, 06:24
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://docs.genesys.com/Documentation/IWD - Product, Release Notes, Vendor Advisory | |
| References | () https://www.offensity.com/en/blog/authenticated-sql-injection-in-the-genesys-iwd-manager-cve-2021-40860-and-cve-2021-40861/ - Exploit, Patch, Third Party Advisory |
Information
Published : 2021-12-08 15:15
Updated : 2024-11-21 06:24
NVD link : CVE-2021-40861
Mitre link : CVE-2021-40861
CVE.ORG link : CVE-2021-40861
JSON object : View
Products Affected
genesys
- intelligent_workload_distribution_manager
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')