Secure Slican IPx WebCTI Against SQL Injection in Admin Endpoint
Authenticated attackers can exploit SQL injection in Slican IPx WebCTI services running versions prior to 6.62.0100, requiring immediate patching.
Key points
- Slican IPx versions before 6.62.0100 contain a high-severity SQL injection flaw.
- The vulnerability exists in the /webcti/admin_json.php endpoint of the WebCTI service.
- Attackers must be authenticated to exploit the improper input neutralization.
Slican IPx telephone exchange systems running versions older than 6.62.0100 face a confirmed security risk involving SQL injection. The flaw resides within the WebCTI service, specifically targeting the /webcti/admin_json.php endpoint. Organizations using these telephony solutions must verify their current software versions immediately to determine if their environments are exposed to this specific vector.
The risk
The National Vulnerability Database rates this issue as high severity with a CVSS score of 8.7. The underlying weakness is classified as CWE-89, indicating improper neutralization of special elements used in an SQL command. This allows an attacker who has already authenticated to the system to execute arbitrary SQL injection attacks against the service.
Who is exposed
Only Slican IPx installations running versions prior to 6.62.0100 are affected by this vulnerability. The issue was resolved in version 6.62.0100, meaning any deployment that has not yet applied this specific update remains susceptible to exploitation through the WebCTI administrative interface.
Cost and compliance
The source material does not provide specific financial costs or direct compliance implications resulting from this vulnerability. However, the high severity rating indicates significant potential for data compromise or system integrity loss if the flaw is successfully exploited by an authenticated adversary within the network perimeter.
Our take on the response
Security teams should prioritize patching this specific endpoint due to its high severity score and the critical nature of telephony infrastructure. Since the flaw requires authentication, organizations must also audit administrative access controls to ensure that only authorized personnel can reach the vulnerable interface until patches are fully deployed.
What defenders should look for
Teams usually monitor web application logs for unusual query patterns originating from authenticated admin sessions. Check whether database error messages are leaking to the client side, which often signals injection attempts. Look for unexpected data retrieval or modification in call detail records. Containment moves typically involve restricting access to the administrative endpoint and reviewing recent administrative activity for anomalies.
What to do and how to stay safe: Slican
- Verify your Slican IPx version and upgrade to 6.62.0100 or later if you are running an older build.
- Restrict network access to the /webcti/admin_json.php endpoint to trusted management IPs only.
- Audit administrative credentials used for the WebCTI service to ensure strong authentication practices.
- Monitor web server logs for complex SQL syntax in requests targeting the administrative interface.
Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific file is vulnerable in Slican IPx?
The vulnerability is located in the /webcti/admin_json.php endpoint within the WebCTI service.
Do attackers need to be logged in to exploit this?
Yes, the source material states that an authenticated attacker is required to execute SQL injection attacks.
What version fixes this SQL injection flaw?
The issue was fixed in the IPx series version 6.62.0100.
