Slican IPx WebCTI: SQL injection in admin_json.php endpoint
Summary
The WebCTI service of Slican IPx telephone exchanges does not properly neutralize input to the /webcti/admin_json.php endpoint, which allows SQL injection. An authenticated attacker can execute SQL commands against the database. The attack requires valid credentials for the service.
Affected
- Slican IPx: all versions below 6.62.0100
- CVSS 8.7 (v4.0) as stated in the CVE data; CERT Polska and VulDB list other scores.
Fixed in
- Upgrade to IPx series version 6.62.0100 or later.
Workaround
- Unknown. No vendor workaround was found.
- Restrict access to the WebCTI admin interface to management networks or a VPN (own recommendation, not from the vendor).
- A web application firewall may reduce risk temporarily but is not a substitute for patching.
Exploitation
- Exploited in the wild: no evidence found.
- Public proof of concept: none found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether any Slican IPx system has a WebCTI web interface reachable from outside the management network. If so, treat as high priority.
- Upgrade IPx to version 6.62.0100 or later.
- Restrict WebCTI admin access to trusted networks or VPN.
- After upgrading, rotate WebCTI and database credentials.
- Note: CVE-2026-63315 (plaintext password storage) is fixed in the same release.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT Polska advisory CVE-2026-35088 (covers CVE-2026-63314) cert.pl
- CERT Polska advisory (English path) cert.pl
- Slican WebCTI product page www.slican.pl
- VulDB CVE-2026-63314 vuldb.com
- Vulners CVE-2026-63314 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:33.
Original description (NVD)
WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks. This issue was fixed in IPx series version 6.62.0100.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.