This vulnerability in SOGo before version 5.12.7 allows authenticated users to perform SQL injection attacks through the allContactSearch endpoint's search parameter. The flaw permits execution of arbitrary SQL statements, potentially compromising the database. The vulnerability affects numerous specific SOGo versions, including various builds from 2.2.17a-1 through 5.12.4-1.2. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, and low impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, so patch status is unknown.

Exploitation of this vulnerability could allow an authenticated user to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or denial of service. The CVSS vector suggests low impact on confidentiality, integrity, and availability, but the ability to execute arbitrary SQL statements poses a significant risk to data security and system stability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the allContactSearch endpoint to trusted users only and monitor for suspicious activity related to SQL injection attempts. Avoid exposing this endpoint to untrusted networks or users.