Description

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-08-11T18:17:28.247Z",
  "pubdate": "2026-08-11T18:17:28.247Z",
  "executiveSummary": "Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command vulnerability, commonly categorized as SQL Injection. This security flaw allows an unauthenticated or remote malicious actor to execute arbitrary code within the execution context of the current database or application user. The potential impact of successful exploitation is critical, as it may lead to full system compromise, data exfiltration, or unauthorized modification of database contents. The scope of the vulnerability is changed, indicating that the exploit can impact resources beyond the initial security scope of the vulnerable component. According to the threat parameters, the exploitation of this issue does not require user interaction, lowering the barrier for potential attacks. However, successful exploitation remains contingent upon specific conditions that reside beyond the direct control of the attacker. Organizations utilizing the affected Adobe Campaign Classic product face severe risk implications, including potential breach of sensitive enterprise data and unauthorized code execution capabilities if defensive controls are bypassed or absent.",
  "technicalDetails": "The vulnerability stems from the improper neutralization of special elements within SQL commands processed by Adobe Campaign Classic. This manifests as a classic SQL Injection flaw where user-supplied input or untrusted data is directly concatenated into dynamic database queries or insufficiently sanitized before being parsed by the underlying database engine. The root cause lies in the application's failure to adequately parameterize database queries or enforce strict input validation routines across vulnerable components. Attack flow involves an adversary crafting a specialized input containing malicious SQL syntax or operating system command execution primitives depending on the database backend and application architecture. This payload is transmitted to the vulnerable component via standard communication channels without requiring user interaction. Upon ingestion, the application improperly evaluates the special elements, allowing the injected SQL commands to alter the intended query logic. Depending on database configurations, privileges of the current user, and underlying database features, the injection can be leveraged to escalate privileges, manipulate internal database structures, or interface with system-level functions to achieve arbitrary code execution. The attack operates with the execution context of the current database or application user, meaning post-exploitation impact is bound directly to the permissions granted to that account. Because the vulnerability exhibits a changed scope, the impact extends beyond the immediate application boundary. Although exploitation does not require user interaction, it is strictly dependent on conditions beyond the attacker's control, which may relate to specific environmental prerequisites, internal configuration states, or timing factors required to trigger the vulnerable code path."
}