CVE-2026-63314

Executive Summary

CVE-2026-63314 is a SQL injection vulnerability in the WebCTI service shipped with Slican IPx telephone exchanges, reachable through the /webcti/admin_json.php endpoint. An attacker who holds valid WebCTI credentials can supply improperly neutralized input that is incorporated into a SQL statement, allowing execution of arbitrary SQL against the underlying database. Successful exploitation can expose or alter the exchange's configuration and user data, and depending on database privileges may enable broader compromise of the telephony management plane; the vendor states the issue is fixed in IPx series version 6.62.0100.

Technical Analysis

The affected component is the WebCTI web service that provides the computer-telephony-integration (CTI) administrative interface for Slican IPx telephone exchanges. Per the NVD description, the vulnerability resides in /webcti/admin_json.php and is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command — "SQL Injection").

The described mechanism is standard SQL injection: input received by the admin_json.php endpoint is passed into a SQL query without adequate neutralization (parameterization, escaping, or allow-listing), so attacker-controlled content is interpreted as SQL syntax by the backend database. Because the endpoint is named as an "admin" JSON handler, it is consistent with the description that the reachable functionality is administrative in nature — however, the public description does not disclose the specific HTTP method, parameter names, request body structure, the database engine in use, or the exact query that is injectable. Those implementation details are not available and should not be assumed.

Two points from the description are operationally important:

• Authentication is a precondition. The description states the issue is exploitable by an authenticated attacker. This means the injection is not pre-auth; a valid WebCTI session/credential set is required before the vulnerable code path can be reached. The privilege level required (ordinary operator vs. full administrator) is not specified.
• Remediation boundary is known. The vendor fix is IPx series version 6.62.0100. Instances below that build are presumed affected based on the description; the precise lower bound of affected firmware is not provided.

Attack surface considerations: IPx exchanges and their WebCTI management services are typically deployed on-premises and reachable from corporate LAN segments, and in some deployments they may be exposed to broader networks or the internet if administrators enable remote management or port-forward the web interface. The service is an application-layer HTTP endpoint, so the injection is delivered as an ordinary HTTP request, making it indistinguishable from normal WebCTI traffic at the transport layer without content inspection.

No CVSS vector is published for this CVE in the supplied data (CVSS score N/A), so severity must be assessed qualitatively: a post-authentication SQL injection in a telephony management interface implies high potential impact to confidentiality and integrity of exchange data, with availability impact dependent on database and service resilience. EPSS is 0.00225 (12.2nd percentile), indicating low predicted near-term exploitation activity at the time of writing. There is no evidence of a public proof-of-concept, no Nuclei template, no exploit code, and the CVE is not listed in CISA KEV.

Exploitation Scenarios

No public PoC is available for this CVE; the attack chain below is inferred from the vulnerability class (CWE-89 SQL injection) and the facts given in the NVD description. Specific parameter names, payload syntax beyond generic SQL injection constructs, and post-exploitation primitives are not disclosed and are therefore not fabricated here.

1. Reconnaissance / target identification. An adversary enumerates reachable Slican IPx management interfaces — for example via internet-wide scanning using HTTP content fingerprints such as webcti, admin_json.php, or page titles associated with the WebCTI login, or via internal network discovery on telephony/VoIP management VLANs. The goal is to identify hosts running the WebCTI service and confirm the /webcti/admin_json.php endpoint responds.
2. Access acquisition. Because exploitation requires authentication, the attacker must first obtain WebCTI credentials. This could be via default or weak credentials, credential reuse, phishing of an operator, or prior compromise of a management workstation. Only after establishing a session does the vulnerable code path become reachable.
3. Triggering the flaw (vulnerability-class level). The attacker sends a request to /webcti/admin_json.php containing crafted input in one of the request's data fields. Because that input is incorporated into a SQL statement without neutralization, SQL metacharacters and clauses embedded in the input are parsed as query logic rather than data. This is the defining behavior of SQL injection: the boundary between "data" and "code" is not enforced. The exact field, encoding, and query shape are not publicly documented.
4. Post-exploitation impact. Depending on the database account used by the WebCTI service, successful injection could permit reading sensitive data from the exchange's database (configuration, extensions, user/credential material), modifying or deleting records, and potentially bypassing application-level authorization checks that rely on database queries. If the database account has sufficient privileges and the DBMS supports it, further actions such as stacked queries or file/command execution capabilities could be attempted (subject to the engine and configuration) — but this is speculative at the class level and not confirmed for this product.
5. Telephony-plane implications. Compromise of a telephone exchange management interface can have effects beyond the web application itself, such as manipulation of call routing, extension configuration, or voicemail data. The specific downstream effects for IPx are not described in the CVE data and should be validated during testing.

Impact Assessment

• Confidentiality: High (inferred). SQL injection into an administrative JSON handler can expose database contents, which for a telephony exchange may include user records, extension mappings, configuration, and potentially stored credentials or secrets.
• Integrity: High (inferred). Injected queries can modify or delete data, altering exchange configuration or user state.
• Availability: Dependent. Availability impact is not specified; it depends on whether injected queries can disrupt database contents or service operation.
• Scope: Unchanged (assumed). The vulnerable component is the WebCTI web service/database; no evidence in the description of scope escalation to other components.
• Privileges Required: Low (authenticated). The description explicitly requires authentication, which materially reduces the exposed attacker population versus a pre-auth flaw. The required role is unspecified.
• Attack Vector: Network. The endpoint is an HTTP service and can be reached over the network if exposed.

Business impact: Slican IPx exchanges are enterprise PBX/telephony infrastructure. A compromised management plane can translate into toll fraud, call interception or rerouting, denial of voice services, and leakage of organizational directory and configuration data. Organizations with regulatory obligations around communications (e.g., financial services, healthcare) should treat unauthorized modification of the exchange as a potentially reportable event.

Blast radius: Limited to IPx deployments running WebCTI below version 6.62.0100 that are network-reachable by an authenticated user. Because exploitation is post-auth, the primary risk is insider threat, compromised operator accounts, and lateral movement from a compromised management network rather than mass internet exploitation. EPSS is low (0.00225), and there is no KEV listing, no public exploit, and no Nuclei coverage — consistent with a targeted rather than opportunistic risk profile.

Detection Guidance

Detection should focus on (a) anomalous SQL-like syntax in requests to /webcti/admin_json.php, (b) abnormal database error responses or HTTP 500s from the WebCTI service, and (c) unusual authenticated activity against the management interface. The rules below are generic, vulnerability-class detections because specific parameters are not disclosed.

Sigma Rule

title: SQL Injection Attempt Against Slican WebCTI admin_json.php
id: 9f2c1a7e-3b6d-4c1e-9a5f-slican0001
status: experimental
description: Detects SQL metacharacter patterns in HTTP requests to the Slican WebCTI admin_json.php endpoint (CVE-2026-63314).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-63314
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_endpoint:
    cs-uri-stem|endswith: '/webcti/admin_json.php'
  selection_sqli:
    cs-uri-query|contains:
      - "' or "
      - "' OR "
      - "union select"
      - "UNION SELECT"
      - "sleep("
      - "benchmark("
      - "--"
      - "/*"
  condition: selection_endpoint and selection_sqli
falsepositives:
  - Legitimate administrative tooling that submits unusual characters
  - Security scanners performing authenticated assessments
level: high
tags:
  - attack.t1190
  - cwe.89
  - cve.2026.63314

YARA Rule

rule CVE_2026_63314_Slican_WebCTI_SQLi
{
    meta:
        description = "Detects SQL injection payload patterns targeting Slican WebCTI admin_json.php (CVE-2026-63314) in HTTP request bodies or log captures"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-63314"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ep1 = "/webcti/admin_json.php" ascii nocase
        $ep2 = "webcti" ascii nocase
        $sq1 = "UNION SELECT" ascii nocase
        $sq2 = "' OR '" ascii nocase
        $sq3 = "' OR 1=1" ascii nocase
        $sq4 = "SLEEP(" ascii nocase
        $sq5 = "BENCHMARK(" ascii nocase
        $sq6 = "information_schema" ascii nocase
        $sq7 = "-- " ascii
        $sq8 = "/*" ascii

    condition:
        any of ($ep*) and any of ($sq*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-63314 Slican WebCTI SQL Injection Attempt in admin_json.php"; flow:established,to_server; http.uri; content:"/webcti/admin_json.php"; http.uri; content:"admin_json.php"; http.method; content:"POST"; pcre:"/(union[\s\S]{0,10}select|'\s*or\s*'?\d|sleep\s*\(|benchmark\s*\(|information_schema)/i"; classtype:web-application-attack; reference:cve,2026-63314; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-63314; sid:90063314; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "POST" and url.path : "/webcti/admin_json.php" ]
  [ network where http.request.method == "POST" and url.path : "/webcti/admin_json.php"
      and url.query : ("*union*select*", "*' or *", "*sleep(*", "*benchmark(*", "*information_schema*") ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=stream:http
| search uri_path="/webcti/admin_json.php" OR uri="*admin_json.php*"
| eval sqli_like=if(match(_raw, "(?i)(union[\s\+]*select|'\s*or\s*'?\d|sleep\s*\(|benchmark\s*\(|information_schema|--\s|/\*)"),1,0)
| where sqli_like=1
| stats count min(_time) as first_seen max(_time) as last_seen values(src) as sources by uri, uri_path, src_ip, dest
| sort - count

Wazuh OSSEC Rule

<group name="web,webcti,sqli,">
  <rule id="100314" level="12">
    <if_sid>31100</if_sid>
    <id>^/webcti/admin_json.php</id>
    <match>union select|' or '|sleep\(|benchmark\(|information_schema|--</match>
    <description>CVE-2026-63314: Possible SQL injection attempt against Slican WebCTI admin_json.php.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_63314,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was found in any tracked source; no vendor advisory URL, workaround, or hotfix reference is available in the supplied data. The NVD description states the issue is fixed in Slican IPx series version 6.62.0100, so that build should be treated as the target version, but this should be verified directly with the vendor before relying on it.

1. Immediate mitigations (while confirming patch availability):

   • Restrict network access to the WebCTI service. Do not expose /webcti/ to the internet; place the management interface on a segregated management VLAN with strict ACLs, allowing only authorized administrator workstations.
   • Enforce strong, unique credentials for WebCTI and remove or disable unused accounts; because exploitation is authenticated, credential hygiene directly reduces exploitability.
   • Monitor /webcti/admin_json.php for SQL-metacharacter payloads and for abnormal 500-level responses or database errors (see Detection Guidance).
   • Consider temporary web application firewall (WAF) rules that inspect requests to /webcti/admin_json.php for SQL injection patterns as a compensating control. Note that WAF evasion is possible and this is not a fix.
   • Review logs for prior authenticated access to the administrative endpoint from unexpected sources.

2. Patch / upgrade steps:

   • Consult Slican support/vendor documentation for IPx series firmware and confirm that version 6.62.0100 (or later) addresses CVE-2026-63314.
   • Inventory all IPx exchanges and record current firmware versions; prioritize internet-reachable or broadly reachable WebCTI instances.
   • Schedule maintenance-window upgrades to 6.62.0100, taking a configuration backup and validating telephony functionality afterward.
   • Record evidence of upgrade (version string, maintenance log) to close the finding.

3. Long-term hardening:

   • Adopt a routine firmware/patch management process for telephony infrastructure, treating PBX management planes as critical assets.
   • Apply least privilege to the database account used by WebCTI and to WebCTI user roles.
   • Enforce MFA or strong authentication at the network edge protecting the management interface where the product architecture permits.
   • Maintain continuous detection coverage keyed to CVE-2026-63314 and periodically re-check for a vendor advisory or updated firmware notes.

References

• NVD — CVE-2026-63314: https://nvd.nist.gov/vuln/detail/CVE-2026-63314
• CWE-89 — Improper Neutralization of Special Elements used in an SQL Command: https://cwe.mitre.org/data/definitions/89.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-63314 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Slican vendor support/documentation portal (consult for the IPx 6.62.0100 firmware/advisory)

Exploit-in-the-wild evidence: None. EPSS is 0.00225 (12.2nd percentile), there is no CISA KEV entry, no public PoC, no Nuclei template, and no known threat actor campaign associated with CVE-2026-63314 in the available data.