CVE-2026-61518
Received Received - Intake

Authenticated SQL Injection in ISPConfig Remote API

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not block quote-free boolean payloads and does not reject requests in its default configuration. A remote API user holding any single low-privilege function permission can inject arbitrary SQL to delete or modify records across all tenants in the control panel database and extract arbitrary data via blind boolean inference, including password hashes and client records.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-61518
EUVD
EUVD-2026-62663

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ispconfig ispconfig From 3.2.0 (inc)
ispconfig ispconfig From 3.3.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ISPConfig has an authenticated SQL injection flaw in its Remote API. The primary_id parameter in delete and update methods is directly inserted into SQL WHERE clauses without proper integer casting or parameterized queries. This allows low-privilege API users to inject malicious SQL, enabling record deletion, modification, or data extraction across all tenants in the database.

Detection Guidance

To detect this vulnerability, monitor API requests to ISPConfig's Remote API for suspicious primary_id parameters in delete or update methods. Look for quote-free boolean payloads or unusual SQL-like patterns in request logs. Use tools like Burp Suite or OWASP ZAP to intercept and analyze API traffic for improperly formatted primary_id values.

Impact Analysis

An attacker with low-privilege API access could delete or alter critical records, extract sensitive data like password hashes or client information, or cause service disruption. The vulnerability bypasses default protections, making it easier to exploit than typical SQL injection flaws.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or deletion, violating GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Non-compliance risks include legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately update ISPConfig to the latest patched version. As a temporary measure, restrict API access to trusted IPs and disable low-privilege API permissions. Review and audit all API logs for signs of exploitation. Implement strict input validation for primary_id parameters by casting to integers or using parameterized queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61518. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart