IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable to a SQL injection flaw that permits an administrative user to send crafted SQL statements. This flaw could enable the attacker to read, insert, modify, or delete data in the product’s back‑end database, potentially exposing sensitive business information and corrupting service data.

Affected products include IBM Sterling B2B Integrator and IBM Sterling File Gateway. Vulnerable versions are 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, and 6.2.1.0 through 6.2.1.1_1.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, the flaw requires an administrative account to send malicious SQL, so the attacker must either compromise or have privileged credentials. If an internal threat is present or the system is exposed, the impact could be significant data loss or tampering. Prompt remediation is recommended to mitigate the risk.