CyberRota Analysis
AI-GeneratedThe Zalktis accounting application is vulnerable to SQL injection through trading-partner-controlled text fields in electronic invoices, allowing attackers to manipulate SQL queries by injecting malicious input. This flaw can lead to unauthorized data access or modification, posing a significant risk to the integrity and confidentiality of sensitive financial information. Organizations using versions prior to 2026.1.586 and 2026.2.592 should prioritize patching this vulnerability to mitigate potential exploitation.
Original NVD Description
SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Dazadi.sql_txt(), is not invoked on these code paths, so a party that sends an invoice can break out of the string literal and alter the query logic. This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.