Ispconfig3
Monthly
Authenticated SQL injection in ISPConfig's Remote API allows any API user holding a single low-privilege function permission to read, modify, or delete data across all hosted tenants in the control panel database. The vulnerability exists because the primary_id parameter in DELETE and UPDATE API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized binding, and the built-in injection scanner fails to block quote-free boolean payloads by default. A publicly available proof-of-concept was published by VulnCheck and researcher geo-chen, enabling blind boolean inference attacks to extract password hashes and client records spanning the entire multi-tenant environment.
Authenticated SQL injection in ISPConfig's Remote API allows any API user holding a single low-privilege function permission to read, modify, or delete data across all hosted tenants in the control panel database. The vulnerability exists because the primary_id parameter in DELETE and UPDATE API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized binding, and the built-in injection scanner fails to block quote-free boolean payloads by default. A publicly available proof-of-concept was published by VulnCheck and researcher geo-chen, enabling blind boolean inference attacks to extract password hashes and client records spanning the entire multi-tenant environment.