Authenticated SQL Injection in ISPConfig Remote API

ISPConfig (CVE-2026-61518) contains a critical authenticated SQL injection vulnerability within its Remote API. The vulnerability stems from improper handling of the 'primary_id' parameter used in 'delete' and 'update' API methods. Specifically, the application concatenates this user-supplied input directly into SQL WHERE clauses without implementing integer casting or parameterized query binding. The product's internal SQL injection scanner fails to validate quote-free boolean payloads by default, allowing attackers to bypass existing protections. An attacker with access to an account possessing even minimal API permissions can leverage this flaw to perform blind boolean inference, enabling the exfiltration of sensitive information, such as password hashes, or the unauthorized deletion and modification of database records across all managed tenants.

Impact

Successful exploitation allows a low-privilege authenticated user to compromise the integrity and confidentiality of the entire ISPConfig database. This includes unauthorized access to client records and administrative credentials across all tenants. Given the control panel's role in managing hosting infrastructure, the ability to manipulate database entries represents a significant risk to the security of all downstream sites and services managed by the ISPConfig instance.

Recommendation

• Upgrade ISPConfig installations to the version containing the security patch for CVE-2026-61518 as soon as it is released by the vendor.
• Review all user permissions assigned to Remote API accounts and enforce the principle of least privilege to ensure users only have access to necessary API methods.
• Enable and strictly configure WAF rules to inspect API requests for SQL injection patterns, specifically targeting boolean-based payloads in the 'primary_id' field.
• Audit database and API access logs for anomalous patterns such as unexpected boolean variations or high volumes of requests targeting 'delete' or 'update' methods from low-privilege accounts.