CVE-2026-15482 is a SQL injection vulnerability affecting Aster Telecom Azcall versions 10 and 11. It occurs due to insufficient input validation in the HTTP handler component processing the /azcall/adm/gestao_loja/sis.php?t=consultar endpoint. Attackers can remotely exploit this by manipulating the 'nome', 'perfil', or 'status' parameters to inject SQL commands. The vulnerability is publicly disclosed with an exploit available, but the vendor has not issued any response or fix. The CVSS 4.0 base score is 6.9, indicating a medium severity risk with network attack vector and no privileges or user interaction required.

Successful exploitation allows remote attackers to perform SQL injection attacks, potentially leading to unauthorized data access or modification within the affected Azcall application. The vulnerability affects core HTTP handler functionality related to query parameters, which could compromise the confidentiality and integrity of backend databases. No evidence of active exploitation in the wild is reported, but a public exploit exists.

No official patch or remediation is currently available from the vendor. Users should apply strict input validation and sanitization on the affected parameters ('nome', 'perfil', 'status') as a temporary mitigation. Monitor for any vendor advisories for future updates. Consider restricting access to the vulnerable endpoint if possible until a fix is released.