Description

SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Dazadi.sql_txt(), is not invoked on these code paths, so a party that sends an invoice can break out of the string literal and alter the query logic. This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T17:17:29.207Z",
  "pubdate": "2026-08-13T17:17:29.207Z",
  "executiveSummary": "A SQL injection vulnerability exists in the Zalktis accounting application via trading-partner-controlled text fields within received electronic invoices.\nThe flaw allows remote attackers supplying malicious electronic invoices (UBL/PEPPOL) or e-commerce exports to execute arbitrary SQL commands against the underlying database.\nThe affected products are Zalktis versions before 2026.1.586 and before 2026.2.592.\nThe risk implications include potential unauthorized data access, data modification, or database compromise depending on database privileges.\nAttacker capabilities involve injecting arbitrary SQL syntax by breaking out of string literals within partner-controlled invoice data fields.\nExploitation requires the application to process a maliciously crafted electronic invoice or e-commerce export containing the SQL injection payload.",
  "technicalDetails": "The vulnerability resides in code paths responsible for importing received electronic invoices, including UBL/PEPPOL formats, and e-commerce exports within the Zalktis accounting application.\nThe root cause of the vulnerability is the use of direct string concatenation to construct SQL statements from trading-partner-controlled text fields without employing parameterized queries or proper input escaping.\nThe application contains an internal escaping helper function, Dazadi.sql_txt(), but this function is not invoked along the vulnerable import code paths, leaving input fields entirely unvalidated and unescaped.\nAn external party sending an electronic invoice can craft input containing SQL metacharacters that break out of the intended string literal context, thereby altering the logical structure of the executed SQL query.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious electronic invoice (UBL/PEPPOL) or e-commerce export containing a payload designed to manipulate SQL execution logic. Second, the victim or automated system imports the received e-invoice into the Zalktis application. Third, the application extracts partner-controlled text values from the invoice data structure. Fourth, the application concatenates these raw, unescaped values directly into SQL statement text strings. Finally, the database executes the resulting altered query, achieving unintended data retrieval, manipulation, or command execution based on the injected syntax."
}