CVE-2026-15482: SQL Injection in Aster Telecom Azcall Admin Panel

Executive Summary

A high-severity SQL injection vulnerability has been disclosed in Aster Telecom Azcall versions 10 and 11, tracked as CVE-2026-15482 with a CVSS score of 7.3 (HIGH). The flaw exists in the platform's HTTP handler component, where attacker-controlled URL parameters are not properly sanitized before being incorporated into database queries.

Published by NVD on July 12, 2026, this vulnerability exposes telecom platforms to database extraction, authentication bypass, and potential further compromise of backend systems.

Vulnerability Overview

Technical Details

Root Cause

The vulnerability resides in the file sis.php within the Azcall admin panel (/azcall/adm/gestao_loja/). The PHP script accepts the t=consultar query action, and the parameters nome, perfil, and status are passed directly into SQL queries without adequate sanitization or parameterization.

This is a classic unsanitized input SQL injection — one of the most persistent and well-understood vulnerability classes in web application security.

Vulnerable Endpoint

GET /azcall/adm/gestao_loja/sis.php?t=consultar&nome=[INJECT]&perfil=[INJECT]&status=[INJECT]

An attacker who can reach this endpoint can manipulate the SQL query executed against the backend database.

Attack Scenarios

Scenario 1: Data Extraction
- Inject UNION-based or blind SQLi payload into `nome` parameter
- Extract user credentials, customer records, billing data from database
 
Scenario 2: Authentication Bypass
- Manipulate `perfil` or `status` conditions to bypass access controls
- Gain unauthorized access to restricted admin functions
 
Scenario 3: Database Enumeration
- Enumerate database schema, tables, and column names
- Map internal data structures for targeted extraction

SQL Injection Classes Applicable

About Aster Telecom Azcall

Azcall is a telecom management platform used by service providers to manage stores, subscriptions, and customer accounts. The admin panel (/adm/) is the internal management interface for operators. SQL injection in this context puts at risk:

• Customer PII (names, contacts, billing details)
• Subscription and service data
• Operator credentials and access tokens
• Internal business data managed through the platform

Affected Versions

Check with the vendor for patch availability and upgrade paths.

Remediation

Immediate Actions

1. Restrict access to /azcall/adm/ — limit to trusted IP ranges via firewall or web server ACLs
2. Apply vendor patch if available — contact Aster Telecom for updated builds
3. Implement a Web Application Firewall (WAF) rule to block SQL injection patterns on the affected parameters
4. Audit logs for existing exploitation — look for SQLi payloads in request logs targeting sis.php

Developer Remediation (If Code Access Is Available)

Replace raw query construction with parameterized queries / prepared statements:

// VULNERABLE (do not use)
$query = "SELECT * FROM loja WHERE nome = '" . $_GET['nome'] . "'";
 
// SAFE — parameterized query
$stmt = $pdo->prepare("SELECT * FROM loja WHERE nome = ?");
$stmt->execute([$_GET['nome']]);

Also apply:

• Input validation — whitelist acceptable values for perfil and status
• Least privilege — database user for the app should have minimal permissions
• Error suppression — disable verbose database error output in production

Detection

Log Review

Search web server access logs for SQLi indicators targeting the vulnerable path:

grep "sis.php" access.log | grep -iE "(union|select|sleep|benchmark|0x|--|%27|%22)"

Indicators of Compromise

Key Takeaways

1. CVSS 7.3 HIGH — SQL injection in Aster Telecom Azcall admin panel
2. Parameters nome, perfil, status in sis.php are vulnerable to injection
3. Restrict admin panel access via IP allowlisting immediately
4. Apply WAF rules to block SQLi patterns on the affected endpoint
5. Engage the vendor for an official patch — consider upgrading or migrating if unsupported

References

• NVD — CVE-2026-15482
• OWASP SQL Injection Prevention Cheat Sheet
• CISA Known Exploited Vulnerabilities Catalog