Interuse i-Bos CVE-2026-59508

Requires network access to the i-Bos 3.0 application and an injectable input parameter reachable without authentication (PR:N). The HIGH attack complexity (AC:H) is the key limiting factor: successful exploitation depends on a condition not fully under the attacker's control - consistent with blind/inferential SQL injection needing many requests, specific database back-end behavior, or a particular application state rather than a direct, reliable single-request injection. Impact is limited to confidentiality (data disclosure); per the provided vector there is no integrity or availability impact, so this does not by itself yield data tampering or service disruption. Exploitation is constrained to the i-Bos 3.0 version specifically.

This is a moderate-severity SQL injection (CWE-89) in Interuse i-Bos 3.0 with a CVSS 3.1 base score of 5.9. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N indicates a network-reachable, unauthenticated (PR:N) flaw, but the HIGH attack complexity (AC:H) and confidentiality-only impact (C:H/I:N/A:N) significantly temper the real-world risk - the AC:H suggests the attacker must satisfy a condition outside their control (e.g. a blind/time-based injection or specific input state) rather than a trivial single-shot injection, which is why the score lands at 5.9 rather than the ~9+ a clean unauthenticated SQLi would score. No EPSS probability, CISA KEV listing, or public exploit code is present in the provided data, so there is no evidence of active exploitation or weaponization; this is a disclosure-stage finding from Israel's INCD. Note one internal tension worth verifying with the vendor: a SQL injection rated I:N/A:N (no integrity or availability impact) is unusual, as injection flaws frequently permit data modification - the classification implies read-only data exfiltration, but confirm whether write/stacked-query vectors were simply not assessed. Overall this is a 'high-CVSS-is-actually-moderate' case: a genuine vulnerability, but not an urgent, mass-exploitable priority absent exploitation signals.

A remote, unauthenticated attacker submits crafted input to an injectable parameter in the i-Bos 3.0 web interface to manipulate backend SQL queries and read sensitive database contents. Because CVSS complexity is HIGH, the attacker likely relies on a blind or time-based technique requiring multiple iterative requests rather than a single payload. No public exploit code or active exploitation has been identified at time of analysis.