IBM CVE-2025-36368

CVSS 6.5 (Medium) reflects moderate real-world risk with nuanced factors: Network-accessible (AV:N) with low attack complexity (AC:L), but requires high privileges (PR:H)—limiting the threat actor pool to administrative users or those with lateral movement to admin accounts. No confidentiality impact on availability (A:N) reduces severity compared to full database compromise attacks. The lack of confirmed KEV status, public POC, or EPSS data suggests this is not actively exploited in the wild. However, the high impact on confidentiality and integrity (C:H, I:H) makes this a priority for organizations using affected Sterling versions, particularly those with strict separation of admin duties. Risk escalates significantly if admin credentials are compromised through phishing, insider threats, or other lateral movement techniques. This is a real priority for Sterling deployments but lower urgency than unauthenticated remote code execution vulnerabilities.

An attacker with administrative credentials to IBM Sterling B2B Integrator (obtained via credential stuffing, phishing, or insider threat) logs into the administrative interface. The attacker discovers an input field in the Sterling UI that constructs a SQL query (e.g., a search or reporting function). The attacker injects malicious SQL syntax (e.g., ' OR '1'='1; DROP TABLE transactions;--) into the field. Due to lack of input validation, the injected SQL is concatenated directly into the query and executed against the backend database. The attacker can then: (1) extract sensitive B2B transaction data, customer information, or encryption keys; (2) modify transaction records to alter routing or authorization; (3) delete audit logs to cover tracks; (4) insert malicious data. The attack requires network access to the Sterling administrative interface and valid admin credentials, making it most plausible in scenarios involving compromised admins or highly privileged insider threats. No public POC is known, limiting opportunistic exploitation.