Eleveo Call Recording Software 9.7.0 contains an LDAP injection vulnerability in the User Management component's /callrec/userAddAction.do endpoint. An attacker can remotely manipulate the Username parameter to perform LDAP injection attacks. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and partial confidentiality impact. The vendor was notified but has not responded, and no official patch or remediation guidance is available. Public exploit code exists.

Successful exploitation of this LDAP injection vulnerability could allow an attacker to manipulate LDAP queries, potentially leading to unauthorized information disclosure or modification within the LDAP directory used by the software. The impact is rated medium severity with partial confidentiality impact and no integrity or availability impact reported.

No official patch or remediation guidance is currently available from the vendor. Since the vendor has not responded and no fix is published, users should consider applying compensating controls such as input validation and restricting access to the vulnerable endpoint until a patch is released. Monitor vendor channels for updates. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.