Unauthenticated SQL Injection in Sangoma Switchvox SMB Edition

Executive Summary

This is an unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3. The /pa endpoint processes XML content with a PhoneIP value that is directly inserted into PostgreSQL queries without sanitization. An attacker can exploit this to execute arbitrary SQL commands, including database operations and remote code execution, using a single crafted request.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for unauthenticated SQL injection attempts targeting the /pa endpoint in Sangoma Switchvox SMB Edition 8.3. Monitor PostgreSQL logs for suspicious queries containing <PolycomIPPhone> tags or unusual input in the PhoneIP field. Use network traffic inspection tools like tcpdump or Wireshark to capture and analyze requests to /pa with XML payloads.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal, modify, or delete sensitive data from the database, install malware, or take control of the system. Since no authentication is required, any external attacker with network access to the vulnerable endpoint can exploit this issue.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face fines, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately apply the latest security patch from Sangoma for Switchvox SMB Edition 8.3. If a patch is unavailable, restrict network access to the /pa endpoint using firewalls or disable it entirely. Implement input validation for XML content and enforce strict parameterized queries in PostgreSQL. Consider isolating the database server from untrusted networks.

Useful 0 Not Useful 0