A critical SQL injection vulnerability in the Zalktis accounting application allows remote attackers to compromise sensitive database contents.

The application fails to properly neutralize special characters in input fields (CWE-89, CWE-20), allowing unauthenticated attackers to inject malicious SQL commands through electronic invoice data.

This vulnerability allows an attacker to interact directly with the database, potentially leading to unauthorized data exfiltration, modification of financial records, or total administrative takeover of the accounting system. With a CVSS score of 8.8, the potential for catastrophic data loss and regulatory non-compliance is extremely high.

Immediate Action: Upgrade to version 2026.1.586 (legacy branch) or 2026.2.592 (current branch) immediately.

Proactive Monitoring: Audit database logs for unusual query patterns, such as unexpected UNION selects or attempts to access system tables.

Compensating Controls: Implement strict input validation on all invoice-processing gateways and ensure the database user account has minimal permissions.

Public Exploit Available: No confirmed public exploit (no weaponized module or curated PoC confirmed in available data).

Given the sensitivity of financial data processed by Zalktis, patching is critical. Organizations must verify their current version and update to the provided secure releases as soon as possible to protect against unauthorized database access.