CVE-2026-48188: SQL Injection via MySQL Quote Method

Synopsis

SQL injection in the OTRS and ((OTRS)) Community Edition database layer allows an unauthenticated remote attacker to inject arbitrary SQL through a flaw in how the MySQL quote method handles input when the MySQL/MariaDB server is configured with the NO_BACKSLASH_ESCAPES SQL mode. The vulnerability is reachable over the network with no credentials required and no user interaction needed. Successful exploitation enables authentication bypass, full read access to sensitive database contents, and modification of persisted data. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to reach the OTRS service via HTTP/S from any network-adjacent or internet-facing position.

• AuthenticationNot required

  No credentials of any kind are needed; the injection point is reachable by a completely unauthenticated request.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploit reliability is high under baseline conditions, though exploitation requires the target MySQL/MariaDB server to be configured with the NO_BACKSLASH_ESCAPES SQL mode, which is a specific but not uncommon server-side configuration.

Blast Radius

• Attacker bypasses the authentication layer entirely and gains access to the application as an arbitrary or privileged user.
• Attacker reads stored user credentials, session tokens, customer records, and ticket data from the OTRS database.
• Attacker modifies persisted database rows, including user account data, access control entries, and ticket contents.
• Confidentiality and integrity of all data accessible to the OTRS database user are fully compromised; availability is not directly impacted by this vector.