CVE-2026-15482: Aster Telecom Azcall SQL Injection Flaw

CVE-2026-15482 Overview

CVE-2026-15482 is a SQL injection vulnerability in Aster Telecom Azcall versions 10 and 11. The flaw resides in the HTTP Handler component, specifically in the /azcall/adm/gestao_loja/sis.php?t=consultar endpoint. Attackers can manipulate the nome, perfil, or status arguments to inject arbitrary SQL statements. The attack can be launched remotely without authentication or user interaction. Public exploit code is available, and the vendor did not respond to disclosure attempts. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output).

Critical Impact
Unauthenticated remote attackers can inject SQL statements through multiple parameters in the sis.php endpoint, potentially exposing or altering data stored in the Azcall backend database.

Affected Products

Aster Telecom Azcall 10
Aster Telecom Azcall 11
HTTP Handler component (/azcall/adm/gestao_loja/sis.php)

Discovery Timeline

2026-07-12 - CVE-2026-15482 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15482

Vulnerability Analysis

CVE-2026-15482 affects the administrative interface of Aster Telecom Azcall 10 and 11. The vulnerable endpoint /azcall/adm/gestao_loja/sis.php processes a t=consultar action that accepts three user-controlled parameters: nome, perfil, and status. These parameters flow into a backend SQL query without proper sanitization or parameterization. An attacker submitting crafted values can break out of the intended query context and append arbitrary SQL logic.

Because the endpoint is reachable over the network and requires no authentication or user interaction, exploitation is straightforward. Public exploit details have been released, lowering the barrier for opportunistic attackers. The vendor was notified before disclosure but did not respond, meaning no official patch is confirmed at the time of publication.

Root Cause

The root cause is improper neutralization of special elements in a downstream SQL component [CWE-74]. The sis.php script concatenates request parameters directly into a query string rather than binding them as parameters. This allows metacharacters such as single quotes, semicolons, and SQL keywords to alter query structure.

Attack Vector

An attacker sends an HTTP request to /azcall/adm/gestao_loja/sis.php?t=consultar with malicious payloads in the nome, perfil, or status parameters. The injected SQL executes with the privileges of the application's database user. Depending on database permissions, the attacker can read sensitive records, modify data, or enumerate schema information. The public availability of exploit details increases the likelihood of automated scanning and mass exploitation attempts against exposed Azcall administrative interfaces.

Detection Methods for CVE-2026-15482

Indicators of Compromise

HTTP requests to /azcall/adm/gestao_loja/sis.php containing SQL metacharacters such as ', --, UNION, SELECT, or OR 1=1 in the nome, perfil, or status parameters.
Unusual database query patterns or errors logged by the Azcall application referencing the gestao_loja module.
Unexpected outbound connections or data transfers originating from the Azcall database host following requests to sis.php.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection signatures targeting the sis.php?t=consultar endpoint.
Enable database query logging and alert on anomalous queries originating from the Azcall service account, especially queries containing UNION SELECT or information_schema references.
Correlate HTTP access logs with database logs to identify parameter tampering against nome, perfil, and status.

Monitoring Recommendations

Monitor administrative endpoints under /azcall/adm/ for unauthenticated access attempts and volumetric scanning.
Track failed and successful authentication events on the Azcall database to detect lateral movement following injection.
Retain HTTP and database logs for a minimum of 90 days to support forensic analysis if exploitation is suspected.

How to Mitigate CVE-2026-15482

Immediate Actions Required

Restrict network access to the Azcall administrative interface using firewall rules or a VPN, limiting exposure to trusted management networks only.
Deploy WAF signatures that block SQL injection payloads on the /azcall/adm/gestao_loja/sis.php endpoint.
Review database account privileges used by Azcall and enforce least privilege to limit the blast radius of a successful injection.
Audit recent access logs for the sis.php endpoint to identify prior exploitation attempts.

Patch Information

No vendor patch has been confirmed. According to the disclosure, Aster Telecom was contacted but did not respond. Administrators should monitor the VulDB CVE-2026-15482 entry and the VulDB Vulnerability #377789 record for updates on remediation guidance.

Workarounds

Place the Azcall administrative interface behind a reverse proxy with authentication and IP allowlisting.
Apply virtual patching through a WAF to reject requests containing SQL metacharacters in the nome, perfil, and status parameters.
If the gestao_loja module is not required, block access to /azcall/adm/gestao_loja/ at the web server level until a fix is released.

bash

# Example nginx configuration blocking the vulnerable endpoint
location ~* /azcall/adm/gestao_loja/sis\.php {
    deny all;
    return 403;
}