Description

IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-25T14:17:19.913Z",
  "pubdate": "2026-09-25T14:17:19.913Z",
  "executiveSummary": "IBM Guardium Data Protection version 12.2 contains a critical security vulnerability involving SQL injection within the PESI (Policy Enforcement and Security Intelligence) service. This vulnerability arises from improper neutralization of user-supplied data during database queries. An authenticated attacker can exploit this flaw to execute arbitrary SQL commands against the internal backend database. Successful exploitation allows unauthorized parties to bypass standard application security controls, resulting in the unauthorized disclosure, modification, or deletion of sensitive information managed by the platform. Given that Guardium is designed to protect enterprise data assets, the risk to data confidentiality and integrity is high. The exploitation requires the attacker to possess valid user credentials for the IBM Guardium interface, though no specific administrative privileges are explicitly noted as a prerequisite. Organizations utilizing the affected version should prioritize implementing compensating controls and monitoring for anomalous database query patterns until an official patch is applied.",
  "technicalDetails": "The vulnerability resides within the PESI service component of IBM Guardium Data Protection 12.2. The root cause is identified as an injection vulnerability where input provided to the service is improperly sanitized or parameterized before being concatenated into database queries executed by the backend SQL engine. Because the PESI service interacts directly with the internal database to facilitate policy enforcement and security intelligence operations, this flaw provides a direct vector for cross-boundary data interaction.\nExploitation follows a sequence wherein an authenticated user crafts malicious inputs designed to manipulate the structure of a legitimate SQL query. By injecting standard SQL syntax (such as UNION-based statements or boolean-based blind injection techniques), the attacker can terminate the intended query and append arbitrary commands. The application subsequently executes these modified queries with the permissions assigned to the PESI service account, which often possesses elevated access to internal system tables and protected audit logs.\nThe attack flow proceeds as follows: First, the attacker establishes a valid session within the IBM Guardium Data Protection 12.2 environment. Second, the attacker interacts with the PESI service via the interface, providing input values that have not been adequately validated against a strictly defined schema or expected data type. Third, the application component passes these unsanitized inputs into the SQL query construction layer. Fourth, the database engine executes the malformed query string. Finally, the malicious payload allows the attacker to extract data from unauthorized tables, potentially including configuration parameters, administrative credentials, or sensitive captured data stored within the Guardium repository.\nThe post-exploitation impact includes the total compromise of confidentiality regarding the data stored within the internal database. An attacker could perform data exfiltration, dump internal system schemas, or potentially escalate privileges if the database configuration permits interaction with stored procedures or system-level administrative functions. This vulnerability represents a significant deviation from secure coding practices, specifically the lack of prepared statements or parameterized queries in the affected PESI service communication modules."
}