CVE-2021-40860

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-12-08 · updated 2026-06-17
Weakness: CWE-89

Description

A SQL Injection in the custom filter query component in Genesys intelligent Workload Distribution (IWD) before 9.0.013.11 allows an attacker to execute arbitrary SQL queries via the ql_expression parameter, with which all data in the database can be extracted and OS command execution is possible depending on the permissions and/or database engine.

Affected products

Genesys Intelligent Workload Distribution Manager: before 9.0.013.11 — fixed in 9.0.013.11

How to fix

Upgrade to a fixed version: Genesys Intelligent Workload Distribution Manager 9.0.013.11. Check the vendor advisory for mitigations.

References

https://docs.genesys.com/Documentation/IWD
https://www.offensity.com/en/blog/authenticated-sql-injection-in-the-genesys-iwd-manager-cve-2021-40860-and-cve-2021-40861/
https://docs.genesys.com/Documentation/IWD
https://www.offensity.com/en/blog/authenticated-sql-injection-in-the-genesys-iwd-manager-cve-2021-40860-and-cve-2021-40861/

Get alerted when CVE-2021-40860 or the next vulnerability affects your stack