Description

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-04T16:17:21.133Z",
  "pubdate": "2026-09-04T16:17:21.133Z",
  "executiveSummary": "This vulnerability involves an SQL injection flaw identified within multiple versions of IBM Operational Decision Manager (ODM). The vulnerability allows unauthenticated attackers to bypass security controls and execute arbitrary SQL statements against the backend database. By leveraging the database's functionality, a remote attacker can write a web shell directly to the application's web root, facilitating Remote Code Execution (RCE). The impact of this vulnerability is critical, as it allows for full system compromise, data exfiltration, and unauthorized control over the server hosting the ODM application. Because the exploit does not require authentication, the attack surface is significantly exposed to any network-capable adversary. Organizations utilizing affected versions are at high risk of total environment takeover if remediation is not immediately prioritized.",
  "technicalDetails": "The vulnerability manifests as a classic SQL injection flaw where user-supplied input is not properly sanitized or parameterized before being processed by the database query engine. This oversight permits the injection of malicious SQL syntax into legitimate application queries, allowing an unauthenticated actor to manipulate the intended logic of the database interactions.\nThe attack flow begins with the adversary identifying an input vector within the IBM Operational Decision Manager application that interfaces with the database. By crafting a specifically engineered request containing SQL commands, the attacker manipulates the database query to execute unauthorized statements. Due to the inherent permissions of the database service account, the attacker can move beyond simple data retrieval and invoke advanced database functions.\nSpecifically, the attacker leverages database-level file system primitives (such as 'SELECT ... INTO OUTFILE' or similar capabilities depending on the specific backend RDBMS) to write an arbitrary web-accessible file, such as a JSP or similar script, to the application's web root directory. Once the web shell is written, the attacker performs an HTTP request to the newly created file, triggering the web server to execute the embedded code.\nThis sequence results in Remote Code Execution (RCE) with the privileges of the web application service account. Post-exploitation impact includes persistent backdoor access, lateral movement within the enterprise network, exfiltration of sensitive decision-making data, and potential full-scale system compromise. The vulnerability affects IBM Operational Decision Manager versions 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1. Exploitation occurs over standard network channels and requires no prior access or credentials to the target system, making it an extremely dangerous entry point for sophisticated threat actors."
}