Description

ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not block quote-free boolean payloads and does not reject requests in its default configuration. A remote API user holding any single low-privilege function permission can inject arbitrary SQL to delete or modify records across all tenants in the control panel database and extract arbitrary data via blind boolean inference, including password hashes and client records.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T18:16:51.977Z",
  "pubdate": "2026-08-19T18:16:51.977Z",
  "executiveSummary": "ISPConfig suffers from an authenticated SQL injection vulnerability residing within the Remote API interface. The flaw specifically impacts delete and update API methods where the primary_id parameter is processed unsafely.\nThe vulnerability allows a remote attacker possessing any single low-privilege function permission to execute arbitrary SQL queries against the underlying database. The risk implications are severe, as exploitation enables cross-tenant record modification, record deletion, and unauthorized data extraction including password hashes and client records.\nExploitation relies on authenticated access to the Remote API with minimal privileges. The built-in SQL injection scanner fails to mitigate the risk effectively due to its default configuration, which does not block quote-free boolean payloads or reject suspicious requests out-of-the-box.\nThis vulnerability compromises the confidentiality, integrity, and availability of the entire control panel database across all tenants, representing a critical security risk for hosted environments utilizing ISPConfig.",
  "technicalDetails": "The root cause of the vulnerability is improper input validation and the lack of parameterized query binding within the ISPConfig Remote API. Specifically, the primary_id parameter supplied to delete and update API methods is concatenated directly into SQL WHERE clauses without prior integer casting or safe query preparation.\nThe vulnerable components are the database interaction layers handling update and delete operations exposed through the Remote API. Network exposure is present wherever the Remote API is accessible to authenticated users. Authentication is required, but the privilege requirements are exceptionally low, needing only a single low-privilege function permission to initiate the attack.\nThe built-in SQL injection scanner fails to provide adequate protection as it does not block quote-free boolean payloads and remains permissive in its default configuration, allowing malicious payloads to bypass detection filters.\nThe step-by-step attack flow proceeds as follows: First, the attacker authenticates to the ISPConfig Remote API using credentials associated with any low-privilege function permission. Second, the attacker constructs a crafted API request targeting a delete or update method. Third, the attacker injects malicious SQL syntax into the primary_id parameter, utilizing quote-free boolean payloads to bypass weak detection mechanisms. Fourth, the application concatenates the unsanitized input directly into the SQL WHERE clause. Finally, the database executes the resulting query, allowing the attacker to perform blind boolean inference to extract sensitive data such as password hashes and client records, or manipulate records across all tenants in the control panel database."
}