A SQL injection vulnerability in Netatalk versions 3.1.0 through 4.4.2 allows authenticated attackers to compromise the underlying database, posing a high risk to data integrity and availability.

This is a SQL injection vulnerability (CWE-89) within the cnid backend. The vulnerability requires the attacker to have low-level authenticated access to the system to successfully inject malicious SQL commands.

Successful exploitation of this flaw could allow an attacker to bypass security controls, leading to unauthorized data access, modification, or total system compromise. With a CVSS score of 8.8, this represents a significant threat to business continuity and data confidentiality, as the backend database often contains sensitive configuration or user information.

Immediate Action: Upgrade to Netatalk version 4.4.3 or later to remediate the vulnerability.

Proactive Monitoring: Review database access logs for unusual queries or patterns indicative of SQL injection attempts, particularly those originating from authenticated user sessions.

Compensating Controls: Ensure that the database user account utilized by the Netatalk cnid backend operates under the principle of least privilege to limit the scope of a potential injection attack.

Public Exploit Available: Unknown

Given the severity of potential SQL injection, administrators should prioritize updating to the latest version of Netatalk. Apply the patch as part of the next scheduled maintenance cycle or sooner if the environment is exposed to untrusted users.