This vulnerability involves a SQL injection flaw in SOGo before version 5.12.7. Authenticated users can exploit the newPassword parameter in the password change feature to execute arbitrary SQL commands. This could lead to unauthorized data access or modification. The CVSS vector indicates the attack requires network access, low attack complexity, and privileges with user-level permissions, but no user interaction. The impact includes limited confidentiality, integrity, and availability loss.

Exploitation of this vulnerability could allow an authenticated user to execute arbitrary SQL statements on the backend database. This may result in unauthorized disclosure, modification, or deletion of data, potentially impacting confidentiality, integrity, and availability of the affected system. However, the attack requires authentication and user privileges, limiting the scope of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. In the meantime, restrict access to the password change functionality to trusted users and consider additional input validation or web application firewall rules to mitigate SQL injection risks.