A SQL injection vulnerability in Alinto SOGo Webmail allows authenticated users to perform unauthorized database operations, posing a significant risk to data integrity.

The vulnerability is an SQL injection flaw (CWE-89) located in the addUserInACLs endpoint. Successful exploitation requires the attacker to have authenticated access to the system.

An attacker with valid credentials can leverage this SQL injection to manipulate the backend database, potentially leading to unauthorized data modification, administrative access, or complete compromise of the underlying data store. The high CVSS score of 8.1 reflects the potential for total technical impact on the application's data layer.

Immediate Action: Update Alinto SOGo Webmail to version 5.12.8 or later to incorporate the vendor-provided patch.

Proactive Monitoring: Monitor database logs for anomalous SQL queries or unexpected syntax errors originating from the web application service account.

Compensating Controls: Ensure that the database service account operates with the principle of least privilege to limit the scope of any potential SQL injection impact.

Public Exploit Available: No (Exploit_available: false)

Organizations utilizing SOGo Webmail should prioritize updating to version 5.12.8. SQL injection vulnerabilities are highly dangerous; patching is the only effective way to neutralize the risk to the application's database integrity.