CVE-2026-59109 in Zalktis
Summary
by MITRE • 08/13/2026
SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Dazadi.sql_txt(), is not invoked on these code paths, so a party that sends an invoice can break out of the string literal and alter the query logic.
This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability under discussion represents a critical sql injection flaw within the zalktis accounting application that stems from improper input handling during electronic invoice processing. This weakness specifically manifests when the system imports received e-invoices following ubl or peppol standards, as well as during e-commerce export operations. The root cause lies in the application's failure to properly sanitize user-controlled data before incorporating it into sql query constructs through direct string concatenation methods rather than utilizing parameterized queries or proper escaping mechanisms.
The technical implementation of this vulnerability occurs at the point where partner-controlled text fields from incoming electronic invoices are processed. When importing these documents, zalktis concatenates values directly into sql statement text without appropriate sanitization measures. The application contains a dedicated escaping helper function named dazadi.sql_txt() which should theoretically protect against such injection attempts, but this function is deliberately omitted from the affected code paths. This omission allows malicious actors who control trading partners to craft specially formatted invoice data that can manipulate the sql execution flow.
This vulnerability presents significant operational risks as it enables remote attackers to execute arbitrary sql commands against the application's database. Attackers could potentially extract sensitive financial information, modify accounting records, or even escalate privileges within the database system. The impact is particularly severe because the vulnerability affects standard business processes involving trading partners who may be compromised or malicious entities seeking unauthorized access to financial data. The fact that this affects versions prior to 2026.1.586 and 2026.2.592 indicates a long-standing issue that has persisted across multiple releases without proper mitigation.
From a cybersecurity perspective, this vulnerability aligns with cwe-89 sql injection and maps directly to attack techniques categorized under the mitre att&ck framework within the execution and credential access domains. The weakness demonstrates poor input validation practices and violates fundamental secure coding principles that emphasize the use of parameterized queries or proper escaping mechanisms. Organizations utilizing zalktis accounting systems must urgently implement patches addressing this vulnerability while also conducting thorough security assessments of their trading partner relationships to prevent exploitation through compromised partner accounts.
The remediation strategy requires immediate implementation of parameterized sql queries throughout all code paths that handle external invoice data, ensuring that no user-controlled values are directly concatenated into sql statements. Additionally, the dazadi.sql_txt() helper function must be consistently applied across all relevant code sections to provide proper escaping functionality. Security teams should also implement comprehensive input validation measures and consider network-level protections such as web application firewalls to detect and prevent exploitation attempts. Regular security testing including penetration testing and automated vulnerability scanning should be conducted to identify similar issues within the application's codebase.