CVE-2026-19764

Executive Summary

CVE-2026-19764 is an unauthenticated SQL injection vulnerability in the Raisecom Communication Command and Dispatch Management Platform, affecting versions up to and including 7.6.5. The flaw resides in the /app/users/getpwd.php endpoint, where improper handling of the sip argument permits remote attackers to inject arbitrary SQL statements. Given the low attack complexity, no authentication requirement, and public exploit availability, this vulnerability poses a significant risk to organizations operating Raisecom dispatch platforms in critical communication infrastructure. An exploit can lead to unauthorized data access, modification, or integrity loss in the backend database. At the time of this report, no vendor patch exists and the vendor has not responded to disclosure attempts.

Technical Analysis

The vulnerable component is a PHP-based endpoint located at /app/users/getpwd.php within the Raisecom Communication Command and Dispatch Management Platform. This endpoint is presumed to handle password recovery or user credential lookup functionality — the exact business logic is not disclosed in the public description, but the presence of a getpwd (get password) filename strongly suggests an authentication-related feature that queries the user database.

The vulnerability manifests through the manipulation of the sip argument (Session Initiation Protocol identifier, commonly used as a user identifier in VoIP dispatch environments) passed via HTTP request parameters to this endpoint. The application fails to sanitize or parameterize user-supplied input before incorporating it into a database query, resulting in classic SQL injection (classified as CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component, which encompasses injection classes including SQL).

The attack surface is the HTTP service exposed by the dispatch management platform. Because the vulnerability requires no authentication (PR:N in the CVSS vector) and can be exploited over the network (AV:N) with low complexity (AC:L), any reachable installation is immediately susceptible. The CVSS impact subscores reflect partial confidentiality loss (C:L), partial integrity loss (I:L), and partial availability impact (A:L), suggesting the injection may allow reading sensitive data (e.g., user hashes, SIP account credentials), modifying records, or potentially invoking destructive SQL operations.

Insufficient technical detail is available to determine whether the injection is error-based, blind, or time-based, or whether stacked queries are possible. However, the publicly available exploit indicates that a deterministic attack vector exists. The lack of vendor response and the absence of any patch evidences a 0-day status, with the vulnerability remaining unfixed as of the time of publication.

Exploitation Scenarios

The attack chain for CVE-2026-19764 proceeds as follows:

Step 1 — Reconnaissance/Target Identification: An attacker identifies exposed Raisecom Communication Command and Dispatch Management Platform web interfaces, typically via internet-wide scanning using search engines like Shodan (using the dorks provided in the metadata) or by scanning common HTTP/HTTPS ports (80, 443, 8080). The default web interface of the platform and the known endpoint path /app/users/getpwd.php serve as fingerprinting markers.

Step 2 — Triggering the Flaw: Once the target is identified, the attacker sends an HTTP request to the vulnerable endpoint, manipulating the sip argument. An example request structure is GET /app/users/getpwd.php?sip=<payload> (or equivalent POST request if the argument is passed in the body). The application concatenates the attacker-controlled sip value directly into the SQL query without sanitization.

Step 3 — Payload Execution at the Vulnerability-Class Level: The attacker injects SQL syntax into the sip parameter. At the vulnerability-class level, this could involve classic tautology payloads (e.g., injecting ' OR '1'='1 to bypass logic), UNION-based SELECT statements to extract data from other database tables, or time-based blind payloads to infer data when verbose output is suppressed. The publicly available exploit (status: Public per POC_STATUS) provides a working proof-of-concept for the specific injection point.

Step 4 — Post-Exploitation Impact: Successful exploitation yields indirect access to the backend SQL database. Given the application's purpose (dispatch management), the database likely contains user credentials, SIP account details, call logs, and operational configuration data. The attacker could extract password hashes for offline cracking, enumerate additional users, or modify records to alter dispatch operations. The low availability impact subscore (A:L) suggests that while full catastrophic denial-of-service is not immediately achievable, the attacker could potentially delete or corrupt specific records.

No public PoC details are available beyond the existence of the public exploit; the attack chain is inferred from the vulnerability class and the CVSS vector.

Impact Assessment

The business impact of CVE-2026-19764 is elevated for organizations operating Raisecom dispatch platforms, which are typically deployed in mission-critical communication environments such as emergency services, utilities, public safety, and transportation command centers. A compromise of these systems could result in:

• Confidentiality Breach: Exposure of SIP account credentials, user password hashes, call records, and operational data stored in the backend database.
• Integrity Degradation: An attacker can modify sensitive records, potentially altering dispatch configurations, user permissions, or call routing data, leading to operational disruption or malicious manipulation of communication flows.
• Availability Risk: Inability to rely on the dispatch platform's data integrity could force operational shutdowns or manual workarounds, impacting service continuity.

The CVSS base score of 7.3 classifies this as a HIGH severity vulnerability. However, the real-world risk is amplified by: (1) the lack of authentication required, (2) the exploit being publicly available (significantly lowering the skill barrier for attackers), and (3) the absence of any patch, meaning all affected versions remain vulnerable indefinitely. Organizations subject to compliance frameworks (e.g., NERC CIP for utilities) may face regulatory reporting obligations.

The blast radius is confined to the database reachable by the dispatch platform application. If the database server is co-located or holds records for other services, lateral movement potential exists; however, no evidence supports cross-system compromise via this CVE alone.

Detection Guidance

The following detection rules are crafted to identify exploitation attempts against /app/users/getpwd.php with suspicious sip parameter manipulation. These are baseline rules and should be tuned to organizational context.

Sigma Rule

title: Raisecom getpwd.php SQL Injection Attempt
id: 9b1e9f2a-c7d3-4f8e-9a2d-5b6c3e8f1a04
status: experimental
description: Detects SQL injection attempts against Raisecom Communication Command and Dispatch Management Platform /app/users/getpwd.php endpoint via the sip parameter.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-19764
author: Valtersit Threat Intelligence
date: 2025/06/11
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs for Raisecom dispatch platform'
detection:
    selection:
        cs-method:
            - 'GET'
            - 'POST'
        cs-uri-path:
            - '/app/users/getpwd.php'
        cs-uri-query|contains:
            - 'sip='
            - 'sip%3D'
    filter_keywords:
        cs-uri-query|contains:
            - "'"
            - '"'
            - '%27'
            - '%22'
            - 'union'
            - 'select'
            - 'sleep('
            - 'or 1=1'
            - ';--'
            - '/*'
    condition: selection and not filter_keywords
fields:
    - clientip
    - cs-uri-query
    - cs-user-agent
falsepositives:
    - Legitimate password recovery requests containing URL-encoded special characters
level: high

YARA Rule

rule CVE_2026_19764_Raisecom_SQLi
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects SQL injection payloads targeting Raisecom getpwd.php endpoint"
        cve = "CVE-2026-19764"
        date = "2025-06-11"
        severity = "high"
    strings:
        $endpoint = "/app/users/getpwd.php" ascii nocase
        $sip_param = "sip=" ascii nocase
        $sqli_single_quote = "'" ascii
        $sqli_union = "union" ascii nocase
        $sqli_select = "select" ascii nocase
        $sqli_comment = "--" ascii
        $sqli_tautology = "1=1" ascii
        $sqli_sleep = "sleep(" ascii nocase
    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A
        and $endpoint and $sip_param
        and any of ($sqli_*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT Raisecom getpwd.php SQL Injection Attempt (CVE-2026-19764)";
    flow:to_server,established;
    http.uri;
    content:"/app/users/getpwd.php";
    nocase;
    http.uri;
    content:"sip=";
    nocase;
    pcre:"/sip=[^&\s]*(?:['\"]|union|select|sleep|--|\/\*)/i";
    classtype:web-application-attack;
    sid:202619764;
    rev:1;
    metadata:created_at 2025_06_11, updated_at 2025_06_11;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-19764;
)

Elastic Detection

sequence by source.ip with maxspan=1m
  [network where event.category == "web" and http.request.method in ("GET", "POST") and
   url.path == "/app/users/getpwd.php" and url.query contains "sip="]
  [network where event.category == "web" and
   (url.query matches "*'*" or url.query matches "*union*" or url.query matches "*select*" or
    url.query matches "*sleep(*" or url.query matches "*1=1*" or url.query matches "*--*" or
    url.query matches "*/*" )]

Splunk SPL Query

index=web sourcetype=access_combined
  uri_path="/app/users/getpwd.php"
  (uri_query="*sip=*'*" OR uri_query="*sip=*union*" OR uri_query="*sip=*select*" OR
   uri_query="*sip=*sleep(*" OR uri_query="*sip=*1=1*" OR uri_query="*sip=*--*" OR
   uri_query="*sip=*%27*" OR uri_query="*sip=*%22*")
| stats count by src_ip, uri_path, uri_query, _time
| sort - _time
| head 100

Wazuh OSSEC Rule

<group name="web_application_attack,">
  <rule id="100310" level="12">
    <decoded>apache-accesslog</decoded>
    <match>/app/users/getpwd.php</match>
    <regex>sip=.*(%27|%22|'|"|union|select|sleep\(|1=1|--|\/\*)</regex>
    <description>Raisecom getpwd.php SQL injection attempt detected (CVE-2026-19764)</description>
    <group>attack,sql_injection,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Current Patch Status: Unpatched. Patch confidence is 0/4 — no patch evidence exists from any tracked source, and the vendor (Raisecom) has not responded to disclosure attempts. All versions up to and including 7.6.5 remain vulnerable.

Immediate Mitigations (implement without delay):

1. Network Segmentation: Isolate the Raisecom dispatch management platform from untrusted networks. Place it behind a firewall that permits access only from trusted administrative IP ranges. If the platform does not require external access, block all inbound connections to the web interface.

2. Web Application Firewall (WAF): Deploy a WAF in front of the platform with rules to block SQL injection patterns targeting the /app/users/getpwd.php endpoint. Use the Sigma, Suricata, and Wazuh rules provided above as a starting point for rule configuration.

3. Disable or Restrict the Endpoint: If feasible, block access to the /app/users/getpwd.php endpoint at the reverse proxy or web server level, especially if the password recovery feature is not essential for operations.

4. Database Hardening: Apply the principle of least privilege to the database account used by the application. Ensure the account cannot execute OS-level commands, drop tables, or access unrelated databases. Enable database auditing to detect anomalous queries.

Patch/Upgrade Steps:

• Monitor Raisecom's official website and security advisories continuously for a firmware/software update. The CVE description states the vendor was contacted but did not respond; active monitoring is required.
• Once a patched version is released, test it in a staging environment that mirrors production before deployment, given the critical nature of dispatch systems.
• Maintain rollback capability in the event of upgrade failure.

Long-Term Hardening:

1. Vendor Accountability: Escalate the lack of vendor response through official channels, third-party security coordinators (CERT), or regulatory bodies if the platform is used in critical infrastructure sectors.
2. Input Validation: Although the fix is vendor-side, organizations can add a reverse proxy layer that performs strict allowlist validation of the sip parameter (e.g., allowing only numeric or alphanumeric characters and rejecting special SQL metacharacters).
3. Asset Inventory: Audit the network for any Raisecom dispatch platforms to ensure all instances are accounted for and subject to monitoring.
4. Incident Response Readiness: Prepare or update incident response playbooks to address potential exploitation of this vulnerability, including database forensic collection procedures.
5. Access Review: Revalidate that the dispatch platform web interface is not exposed to the internet or broad internal networks.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-19764 — Official CVE record with description, CVSS vector, and references.
2. Raisecom Official Site: https://www.raisecom.com — Vendor site for monitoring future security advisories and patch releases. The vendor did not respond to disclosure.
3. CWE-74 Reference: https://cwe.mitre.org/data/definitions/74.html — Weakness classification providing context on injection vulnerabilities.
4. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ — Technique mapping for exploitation of public-facing applications.

Threat Actor / Exploit-in-the-Wild Evidence: The NVD description states "The exploit is publicly available and might be used." No specific threat actor campaigns have been publicly attributed to CVE-2026-19764 as of the report date. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. However, the public availability of an exploit underscores the immediate exploitation risk, and security teams should assume opportunistic attackers will weaponize this within short timeframes.