The Zalktis accounting application suffers from an SQL injection vulnerability (CWE-89) due to improper neutralization of special elements in SQL commands. Specifically, when importing received electronic invoices (UBL/PEPPOL) or e-commerce exports, partner-controlled values are concatenated directly into SQL statements using string concatenation without invoking the application's escaping helper function Dazadi.sql_txt(). This allows an attacker who controls invoice data to break out of string literals and manipulate the SQL query logic, potentially leading to unauthorized data access or modification. The vulnerability affects versions prior to 2026.1.586 and 2026.2.592.

Successful exploitation can lead to full compromise of the database confidentiality, integrity, and availability, as indicated by the CVSS vector (Confidentiality: High, Integrity: High, Availability: High). An attacker can manipulate SQL queries to read, modify, or delete data within the database, potentially causing severe operational and data breaches.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid importing untrusted electronic invoices or e-commerce exports. Monitor vendor communications for patches or updates addressing this vulnerability.