The flaw exists in the WebCTI service of Slican IPx telephone exchanges and is confined to the /webcti/admin_json.php endpoint. The code fails to properly neutralize user‑supplied data, giving an authenticated attacker the ability to inject arbitrary SQL. As a result of this CWE‑89 vulnerability, the attacker can read, alter, or delete rows in the underlying database, thereby compromising the confidentiality and integrity of all customer data handled by the service. The attack requires login credentials, so only users with administrative or privileged access can exploit it, but such an account would grant total control over the exchange configuration and records.

All releases of the IPx telephone exchange before the 6.62.0100 patch are affected. Clients should verify their installed version and plan to apply the fixed software to protect against this SQL Injection.

The CVSS score of 8.7 classifies this vulnerability as high severity, yet the EPSS score of less than 1% indicates that real‑world exploitation is unlikely and the issue is not currently listed in CISA’s KEV catalog. Because the vulnerability is authenticated, an attacker needs existing administrative credentials, which can be obtained through legitimate or malicious means. Once breached, the attacker can manipulate sensitive database records. In the context of a managed telephone exchange, this represents a significant risk to data confidentiality and system integrity.