A SQL injection flaw in IBM Storage Protect Server allows authenticated remote attackers to compromise database integrity and confidentiality.

This vulnerability is a SQL injection (CWE-89) flaw where a remote attacker with low privileges can inject malicious SQL commands. By sending specially crafted statements, the attacker can view, add, modify, or delete information stored in the back-end database.

The ability to manipulate the back-end database poses a significant risk to data confidentiality and integrity. With a CVSS score of 7.6, this high-severity vulnerability could lead to unauthorized data exfiltration or the destruction of critical backup metadata, potentially resulting in severe operational disruption or compliance violations.

Immediate Action: Update IBM Storage Protect Server to version 8.2.1 or later as specified in the vendor security advisory.

Proactive Monitoring: Review database access logs for unusual queries or patterns indicative of SQL injection attempts, such as unexpected syntax characters or unauthorized data modification commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to inspect and block malicious SQL injection payloads targeting the server's management interface.

Public Exploit Available: Unknown

Given the potential for unauthorized database manipulation, this vulnerability should be treated with high priority. System administrators must verify their current version against the affected range and apply the recommended update to 8.2.1 immediately to prevent potential data compromise.