EUVD-2026-62663
GHSA-m99h-35x2-cjq2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered via API (AV:N), no complexity beyond credentials (AC:L), low-privilege API account required (PR:L), full C/I/A impact on the multi-tenant database with no scope change beyond ISPConfig itself.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not block quote-free boolean payloads and does not reject requests in its default configuration. A remote API user holding any single low-privilege function permission can inject arbitrary SQL to delete or modify records across all tenants in the control panel database and extract arbitrary data via blind boolean inference, including password hashes and client records.
AnalysisAI
Authenticated SQL injection in ISPConfig's Remote API allows any API user holding a single low-privilege function permission to read, modify, or delete data across all hosted tenants in the control panel database. The vulnerability exists because the primary_id parameter in DELETE and UPDATE API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized binding, and the built-in injection scanner fails to block quote-free boolean payloads by default. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid ISPConfig Remote API account with at least one function permission assigned - even the lowest-privilege single-function grant is sufficient, as the injection occurs in the shared primary_id parameter processing path common to all DELETE and UPDATE API methods. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 accurately captures the severity: the attack is network-delivered (AV:N), requires no special conditions beyond valid API credentials (AC:L, AT:N), demands only low-privilege access (PR:L), and results in full compromise of confidentiality, integrity, and availability within the ISPConfig database (VC:H, VI:H, VA:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has registered or obtained any low-privilege ISPConfig Remote API account - for example a client with permission to manage a single DNS zone - submits a DELETE or UPDATE API request where the primary_id parameter contains a quote-free boolean SQL payload such as '1 AND (SELECT SUBSTRING(password,1,1) FROM ispconfig_users LIMIT 1)=CHAR(36)'. The built-in scanner does not flag the request, the payload is interpreted by the database, and the attacker iterates characters via binary search to extract administrator password hashes and all client records across the entire multi-tenant installation. … |
| Remediation | No vendor-released patch version has been identified at time of analysis; organizations should monitor the ISPConfig project and the VulnCheck advisory at https://www.vulncheck.com/advisories/ispconfig-authenticated-sql-injection-via-remote-api-primary-id-parameter for patch releases and apply them immediately upon availability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit ISPConfig Remote API access logs for suspicious database activity, immediately restrict API user accounts to only essential personnel, and disable the Remote API feature if not actively required for operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today