SQL injection vulnerability in the web interface in Cisco Unity Connection 9.1(1.2) and earlier allows remote attackers to execute arbitrary SQL commands via a crafted POST request, aka Bug ID CSCuv63824.