EUVD-2026-45205
GHSA-m32j-v93f-gfgc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated single-request SQLi over the network with trivial complexity (AV:N/AC:L/PR:N/UI:N); SQL-to-RCE yields full C:H/I:H/A:H on the same appliance, so scope unchanged.
Primary rating from Vendor (SRA).
CVSS VectorVendor: SRA
Lifecycle Timeline
4DescriptionCVE.org
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
Articles & Coverage 2
AnalysisAI
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrary SQL against the backend PostgreSQL database via the /pa endpoint, which concatenates the attacker-supplied PhoneIP value from a <PolycomIPPhone> XML body into queries without parameterization. Because SQL access on this PostgreSQL deployment can be escalated to command execution, a single crafted, unauthenticated request yields full database compromise and remote code execution on the VoIP appliance. There is no public exploit identified at time of analysis, though vendor SRA published a technical writeup, and the CVSS 4.0 base score is 9.3 (Critical).
Technical ContextAI
Switchvox is Sangoma's Unified Communications / IP-PBX platform; the SMB Edition is the small-to-medium-business appliance variant. The flaw is a classic CWE-89 SQL injection: the /pa provisioning endpoint accepts XML documents beginning with the <PolycomIPPhone> element (the auto-provisioning format used by Polycom/Poly desk phones) and takes the client-controlled PhoneIP field, then builds PostgreSQL statements through direct string concatenation instead of using prepared statements or parameter binding. The affected CPE is cpe:2.3:a:sangoma:switchvox_smb_edition:*:*:*:*:*:*:*:* at version 8.3 (104997). Because PostgreSQL exposes primitives (e.g. COPY ... FROM PROGRAM, extension/UDF abuse, or file write) that can be reached once arbitrary SQL is possible, the injection escalates from data access to code execution on the host, which is why the tags include both SQLi and RCE.
RemediationAI
Vendor-released patch: upgrade to Sangoma Switchvox SMB Edition 8.4.0.2 (released July 14 2026, per the vendor release notes at https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026), which is the primary fix and should be applied immediately. Until the upgrade is deployed, restrict network access to the /pa provisioning endpoint so it is reachable only from trusted phone-provisioning VLANs/subnets (for example via firewall or reverse-proxy ACLs), and ensure the Switchvox management/provisioning interface is not exposed to the internet - the trade-off is that overly aggressive filtering of /pa can break legitimate Polycom/Poly auto-provisioning for phones outside the allowed ranges, so allow-list known phone networks rather than blanket-blocking. As defense-in-depth, monitor PostgreSQL and web logs for anomalous /pa requests containing <PolycomIPPhone> bodies or SQL meta-characters in the PhoneIP field, and constrain the database account used by Switchvox to the least privilege necessary (though this appliance's bundled configuration may limit how much can be hardened without vendor support). Technical details are documented at https://labs.sra.io/posts/switchvox/.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today