An unauthenticated SQL injection vulnerability (CWE-89) exists in Sangoma Switchvox SMB Edition 8.3 (104997) at the /pa endpoint. The endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the PhoneIP value from user input into PostgreSQL queries without sanitization or parameterization. This flaw enables a remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database, including potentially executing remote code. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands on the backend PostgreSQL database. This can lead to unauthorized data access, data manipulation, and potentially remote code execution on the affected system. The vulnerability compromises confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, restrict access to the /pa endpoint and monitor for suspicious activity if possible.