ISPConfig EUVD-2026-62663

Exploitation requires a valid ISPConfig Remote API account with at least one function permission assigned - even the lowest-privilege single-function grant is sufficient, as the injection occurs in the shared primary_id parameter processing path common to all DELETE and UPDATE API methods. The Remote API must be network-accessible to the attacker, which is typical in hosted ISPConfig deployments where the API is exposed for client or automation use. Exploitation is limited by the requirement for at least one authenticated API credential; fully unauthenticated exploitation is not possible per the CVSS PR:L designation. The built-in SQL injection scanner does not block this attack in its default configuration, so no non-default defensive setting is required to be absent - the default installation is vulnerable. The attack does not require any specific platform, operating system, or database engine variant beyond a functioning ISPConfig 3 Remote API endpoint.

The CVSS 4.0 score of 8.7 accurately captures the severity: the attack is network-delivered (AV:N), requires no special conditions beyond valid API credentials (AC:L, AT:N), demands only low-privilege access (PR:L), and results in full compromise of confidentiality, integrity, and availability within the ISPConfig database (VC:H, VI:H, VA:H). The most critical risk amplifier is the multi-tenancy blast radius - a single compromised or malicious API account can exfiltrate and tamper with every hosted client's data, including password hashes, without any per-tenant privilege escalation. The existence of a publicly documented proof-of-concept on GitHub means exploitation requires no novel research, and even a mid-sized hosting provider or municipal IT operation in legnica should treat this as an urgent remediation priority rather than a scheduled patch cycle item. CISA KEV status has not been confirmed at time of analysis, meaning mass in-the-wild campaigns have not been formally tracked, but the low exploitation bar combined with a public PoC substantially elevates the probability of opportunistic abuse. EPSS data was not provided in the input, so probabilistic exploitation frequency cannot be quantified, but the combination of low privilege requirement, network accessibility, and working public exploit suggests real-world risk is at the high end of the 8.7 score range.

An attacker who has registered or obtained any low-privilege ISPConfig Remote API account - for example a client with permission to manage a single DNS zone - submits a DELETE or UPDATE API request where the primary_id parameter contains a quote-free boolean SQL payload such as '1 AND (SELECT SUBSTRING(password,1,1) FROM ispconfig_users LIMIT 1)=CHAR(36)'. The built-in scanner does not flag the request, the payload is interpreted by the database, and the attacker iterates characters via binary search to extract administrator password hashes and all client records across the entire multi-tenant installation. A working proof-of-concept demonstrating this technique is publicly available on GitHub.