The Admin REST API in WSO2 products fails to adequately sanitize user-supplied input before incorporating it into SQL statements. An attacker with administrator privileges can thus influence the structure of the executed SQL query, leading to a blind SQL injection attack. This flaw enables the attacker to infer sensitive database information and potentially disrupt database availability, compromising confidentiality through unauthorized data disclosure and integrity and availability through service disruption.

Multiple WSO2 products are affected, including WSO2 API Control Plane, WSO2 API Manager, WSO2 Carbon API Management Implementation, WSO2 Traffic Manager, and WSO2 Universal Gateway. Specific affected versions are not disclosed in the information provided.

The vulnerability carries a CVSS score of 8.7, indicating medium to high risk. The EPSS score is not publicly available, and the vulnerability is not listed in CISA's KEV catalog, suggesting no confirmed exploitation yet. However, the attack requires administrator credentials and involves remote exploitation via the REST API. Because it is a blind injection, a determined attacker can extract database schema details and, by manipulating the query, cause database errors that may lead to service outages. The potential impact spans data confidentiality, integrity, and availability.