Description

IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-13T20:17:16.967Z",
  "pubdate": "2026-08-13T20:17:16.967Z",
  "executiveSummary": "This vulnerability assessment addresses a critical SQL injection flaw present in IBM i 7.6, 7.5, and 7.4. The weakness is classified as a SQL injection vulnerability, which exposes the underlying database management system to unauthorized data manipulation and retrieval.\nThe primary impact of successful exploitation includes the complete compromise of confidentiality, integrity, and availability of information stored within the back-end database. An unauthenticated or remote attacker possessing network connectivity to the targeted system can execute arbitrary SQL statements.\nThis grants the adversary the capability to view, add, modify, or delete sensitive records without proper authorization. The risk implications are severe, as unauthorized database access can lead to cascading failures across enterprise applications relying on the affected IBM i platform.\nExploitation requires the attacker to send specially crafted SQL statements to the vulnerable service, leveraging improper input validation or sanitization mechanisms within the software. Remediation requires applying official vendor patches or updates as provided by IBM to secure the database interface against malicious query injection.",
  "technicalDetails": "The vulnerability resides in the database query handling components of IBM i versions 7.6, 7.5, and 7.4. The root cause stems from the insufficient validation, sanitization, and parameterization of user-supplied input before it is dynamically concatenated and executed as part of SQL queries within the back-end database engine.\nThe affected component processes incoming requests containing database operations. Due to the lack of strict input handling protocols, malicious input containing SQL command structures is interpreted directly by the database interpreter as executable commands rather than passive data parameters.\nThe attack flow begins when a remote adversary crafts a specialized input vector embedding malicious SQL syntax. The attacker transmits this payload over the network via protocols interacting with the vulnerable database interface of the IBM i system.\nUpon receipt, the vulnerable component parses the input and dynamically constructs the SQL statement without proper abstraction or parameter binding. The database engine then executes the resulting query, blending the legitimate operational logic with the attacker-injected instructions.\nNetwork exposure is defined as remote, allowing unauthenticated or remotely positioned threat actors to interact with the database parsing layer. Exploitation does not inherently mandate high-level initial privileges if the entry point lacks authentication enforcement, although exact capability depends on the specific service endpoint targeted.\nThe payload behavior involves the execution of unauthorized database commands. Depending on the intent of the attacker, the injected SQL statements can extract sensitive data via out-of-band channels or union-based queries, insert unauthorized records, alter existing data configurations, or issue deletion commands against critical database tables.\nThe post-exploitation impact spans full data compromise, potential privilege escalation within the database schema, and potential disruption of dependent business logic. The flaw fundamentally breaks the trust boundary between user-supplied input and database command execution."
}