Description

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-12T20:17:39.497Z",
  "pubdate": "2026-08-12T20:17:39.497Z",
  "executiveSummary": "This vulnerability is an SQL injection flaw affecting IBM i versions 7.6, 7.5, 7.4, and 7.3. The security defect arises from improper input validation or insufficient sanitization within the database interface handling mechanisms of the affected systems.\nA remote, unauthenticated attacker possessing network access can exploit this vulnerability by transmitting specially crafted SQL statements to the back-end database. Successful exploitation grants the adversary the capability to bypass security controls and interact directly with the underlying database management system.\nThe operational impact encompasses a complete compromise of confidentiality, integrity, and availability of stored data. The attacker can execute unauthorized database operations, enabling them to view, add, modify, or delete sensitive information residing within the back-end database.\nThe risk implications are critical, as unauthorized database manipulation can lead to data exfiltration, data corruption, or regulatory non-compliance. Mitigation requires applying vendor-supplied security fixes and adhering to secure database query construction practices.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the affected IBM i database interface components to properly sanitize or parameterize user-supplied input before incorporating it into dynamic SQL queries. Consequently, malicious input containing SQL syntax can alter the intended query structure and logic during execution.\nThe vulnerable components reside within the database query processing and handling subsystems of IBM i 7.6, 7.5, 7.4, and 7.3. These subsystems accept input streams from remote clients and process them without enforcing strict data typing or parameterization protocols.\nExploitation requires network exposure to the vulnerable database services and does not necessitate prior authentication or specialized privileges, depending on the specific network configuration and service exposure. An attacker initiates the attack flow by constructing a malicious payload containing specially crafted SQL commands.\nThe attack flow proceeds as follows: First, the attacker identifies an exposed network service or application endpoint on the IBM i system that interacts with the back-end database. Second, the attacker crafts a malicious input string designed to break out of the intended data context and inject arbitrary SQL syntax. Third, the attacker transmits this payload remotely to the target system via standard database communication protocols.\nUpon receipt, the vulnerable component parses the input and dynamically concatenates it directly into the SQL statement without adequate validation. The database engine then executes the modified query, interpreting the injected attacker-supplied commands as legitimate SQL instructions.\nThe payload behavior allows the execution of arbitrary database operations defined by the attacker. Post-exploitation impact includes unauthorized data retrieval (viewing sensitive tables), data insertion (adding records), data tampering (modifying existing entries), and data destruction (deleting database rows or tables). The scope of the impact is bounded primarily by the database privileges assigned to the execution context handling the request."
}