{"id":"CVE-2026-2613","published":"2026-11-02T11:17:31.963","lastModified":"2026-11-02T17:17:44.090","description":"The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements.\n\nA user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.","cvssScore":8.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Admin REST API performs blind SQL injection by embedding unsanitized user input into SQL queries, allowing an authenticated administrator to infer database contents and disrupt service availability.","exploitability":"Exploitation requires valid administrator credentials and knowledge of vulnerable API endpoints; no public exploit exists, but the attack is technically straightforward for a privileged insider.","blast_radius":"Successful exploitation could leak sensitive database contents via time-based or error-based inference and cause denial-of-service through resource exhaustion or targeted query manipulation.","remediation":"Upgrade to the fixed version specified by the vendor; if no version is named, disable the affected Admin REST API endpoint immediately and restrict access to trusted networks or roles until remediated.","detection":"Look for unusually long or time-delayed HTTP responses from the Admin REST API, especially when paired with SQL-specific patterns (e.g., 'SLEEP(', 'WAITFOR DELAY', or repeated sequential requests) in access logs; also monitor for anomalous query execution times in database logs correlated with admin API calls.","tags":["sql-injection","admin-api","blind-sqli","privilege-escalation","availability"],"model":"garnet-coder","analyzedAt":"2026-11-03T09:59:54.522Z"}}