This vulnerability in SOGo before version 5.12.7 involves improper sanitization of the search parameter in the allContactSearch endpoint, enabling authenticated users to perform SQL injection attacks. This can lead to unauthorized data access and potential modification of the database. The CVSS vector indicates network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality, integrity, and availability at a low level.

An authenticated attacker can exploit this SQL injection vulnerability to execute arbitrary SQL commands on the backend database. This could result in unauthorized disclosure, modification, or deletion of data within the affected SOGo instance. The impact is rated medium due to the requirement for authentication and the limited scope of the attack vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the allContactSearch endpoint to trusted users only and monitor for suspicious activity involving this endpoint.