Executive brief
ISPConfig is a web-based control panel used by hosting providers and system administrators to manage domains, email accounts, and server resources. An authenticated attacker with minimal API permissions can inject malicious SQL commands through the API to delete or modify records, extract sensitive data including password hashes, and access information across all customer accounts in the database.
Technical details
The vulnerability is an authenticated SQL injection (CWE-89) in the ISPConfig Remote API's delete and update methods. The primary_id parameter is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not block quote-free boolean payloads in its default configuration. An attacker with any low-privilege Remote API function permission can leverage this to execute arbitrary SQL queries, enabling data exfiltration via blind boolean inference, record modification, or deletion across all tenants. The attack requires valid API credentials but does not require user interaction.
Affected products
- ISPConfig ISPConfig 3.2.0 through 3.3.0
Timeline
- 2026-08-19: disclosed