Alinto SOGo versions prior to 5.12.7 contain an SQL injection vulnerability (CWE-89) when PostgreSQL or MariaDB is used and cleartext passwords are stored. The vulnerability is related to the c_password parameter in the changePasswordForLogin function, which does not properly neutralize special characters in SQL commands. This allows an attacker with low privileges and no user interaction required to potentially execute arbitrary SQL commands, impacting confidentiality and integrity with low impact on availability. The CVSS 3.1 score is 7.1 (high severity) with network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure or modification of sensitive data. The impact affects confidentiality and integrity with limited impact on availability. The vulnerability requires low privileges and no user interaction but has high attack complexity. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid storing cleartext passwords and consider additional protective measures such as restricting database permissions and monitoring for suspicious activity related to password changes. Apply the official patch from Alinto once it is released to address this vulnerability.