An SQL injection vulnerability was discovered in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME).  Cisco Unified CM is used for handling voice and video calls, whereas Cisco Unified CM SME is used for session routing intelligence. This SQL injection vulnerability allows an authenticated remote attacker to conduct SQL injection attacks on any affected system.

Source: GBHackers