ISPConfig 3 exposes a Remote API endpoint that accepts a primary_id parameter in delete and update calls. The value of this parameter is concatenated directly into SQL WHERE clauses without integer casting or prepared statement binding. As a result, an authenticated user who has any low‑privilege API function can inject blind boolean payloads and arbitrary SQL, allowing deletion or modification of records for all tenants and extraction of sensitive data such as password hashes and client records.

All ISPConfig 3 installations that enable the Remote API with its default configuration are potentially vulnerable. No specific version range is indicated, so every deployment of ISPConfig 3 that exposes the Remote API and authorizes any user with API access falls within scope.

The CVSS score of 8.7 reflects a high severity of the flaw. The EPSS score is not available, so the probability of exploitation has not been quantified, but the vulnerability can be leveraged by any authenticated API user with minimal privileges. Exploitation permits compromise of confidentiality, integrity, and can lead to availability loss if critical database entries are deleted or corrupted. The flaw is not listed in CISA’s KEV catalog at this time.