Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special elements used in an SQL command.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T18:17:26.027Z",
  "pubdate": "2026-08-12T18:17:26.027Z",
  "executiveSummary": "This vulnerability involves an SQL injection flaw residing within IBM i versions 7.6, 7.5, 7.4, and 7.3. The root cause stems from the improper neutralization of special elements utilized in SQL commands, which allows an authenticated remote attacker to interact with and alter restricted data structures.\nThe primary impact of successful exploitation is data tampering, specifically unauthorized modification of records within certain SQL tables managed by the database subsystem. The risk implications include a compromise of data integrity and potential violation of compliance or regulatory standards concerning database controls.\nTo achieve successful exploitation, the adversary requires remote network access and valid authentication credentials to interact with the vulnerable interface. Once authenticated, the attacker can supply specially crafted payloads containing malicious SQL control sequences to manipulate query execution logic and bypass input validation mechanisms.",
  "technicalDetails": "The vulnerability is classified as an SQL injection flaw resulting from insufficient input sanitization and improper neutralization of special elements utilized in dynamically constructed SQL commands within the affected database components.\nThe affected products include IBM i versions 7.6, 7.5, 7.4, and 7.3. The vulnerable components are responsible for parsing and executing user-supplied parameters within database query contexts without adequately enforcing separation between executable code and data structures.\nThe attack vector is network-based, requiring the threat actor to possess remote access capabilities alongside valid authentication credentials. Privilege requirements depend on the specific interface, but generally necessitate standard user access capable of issuing database queries or interacting with vulnerable application functions.\nThe step-by-step attack flow proceeds as follows: First, the authenticated attacker identifies an input vector or interface that passes user-controlled parameters directly into backend SQL execution routines. Second, the adversary crafts an input payload containing malicious SQL metacharacters, such as single quotes or concatenated SQL statements, designed to break out of the intended data context. Third, the application concatenates or interpolates this malicious input directly into the dynamic SQL command string without proper parameterization or escaping. Fourth, the database query parser processes the altered command string, interpreting the injected metacharacters as native SQL instructions rather than literal data. Finally, the database executes the modified command, leading to unauthorized data modification within targeted SQL tables.\nThe post-exploitation impact is constrained primarily to the integrity domain, specifically enabling the unauthorized modification, insertion, or corruption of data within accessible SQL tables, which can disrupt dependent business logic and compromise downstream data reliability."
}