Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper neutralization of special elements used in an SQL command.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-12T18:17:26.950Z",
  "pubdate": "2026-08-12T18:17:26.950Z",
  "executiveSummary": "This vulnerability involves improper neutralization of special elements used within an SQL command, leading to an SQL injection vector in IBM i. The flaw allows a remote authenticated attacker to execute unauthorized data modification operations against targeted SQL tables.\nThe affected products include IBM i versions 7.6, 7.5, 7.4, and 7.3. Successful exploitation of this weakness compromises the integrity of database management systems hosted on the platform, allowing threat actors to manipulate table data without adequate authorization or validation controls.\nThe risk implications include unauthorized alteration of business-critical data, potential data corruption, and circumvention of application-level security boundaries. Exploitation requires remote authentication, meaning the attacker must possess valid credentials to access the vulnerable interface before injecting malicious SQL payloads.\nMitigation requires applying vendor-supplied updates or implementing rigorous input sanitization and parameterized query implementations wherever user-supplied data interacts with database execution contexts.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and improper neutralization of special elements utilized in SQL commands. Specifically, the affected component fails to adequately sanitize user-supplied input strings before concatenating or interpreting them within dynamic SQL execution pathways.\nThe vulnerability affects IBM i versions 7.6, 7.5, 7.4, and 7.3. Network exposure depends on the specific service interfaces exposed by the operating system, but the flaw is accessible remotely. Exploitation requires the attacker to be authenticated, indicating that the threat actor must first establish a valid session or leverage compromised credentials to reach the vulnerable SQL processing interface.\nThe attack flow proceeds in several sequential phases. First, the remote authenticated attacker identifies an input vector or parameter that passes user-controlled data directly into an unparameterized SQL query context. Second, the attacker crafts a specialized payload containing SQL syntax and control characters designed to break out of the intended data field and alter the structural logic of the underlying query. Third, the attacker transmits the crafted payload via the network protocol associated with the vulnerable interface. Fourth, the database engine processes the unsanitized string, interpreting the injected elements as executable SQL commands rather than literal data.\nThe payload behavior focuses on data modification, enabling the attacker to issue unauthorized UPDATE, INSERT, or DELETE statements against targeted SQL tables. The post-exploitation impact includes severe data integrity degradation, unauthorized tampering with relational records, and potential violation of regulatory compliance frameworks relying on strict database access controls."
}