title: SQL Injection Vulnerability in Some ZTE Mobile Internet Products
description:
There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak.
problem types: CWE-20 Improper Input Validation
affected:
{
defaultStatus: unaffected
platforms: Linux
product: Mobile Internet Products
vendor: ZTE
versions:
lessThanOrEqual: V1.0.0B01, status: affected, version: BD_MF833U1V1.0.0B01, versionType: V1.0.0B01
lessThanOrEqual: V1.0.0B04, status: affected, version: CR_LVWRGBMF286RV1.0.0B04, versionType: V1.0.0B04
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
BD_MF833U1V1.0.0B02,
CR_LVWRGBMF286RV1.0.1B01