CVE-2026-9586
Description
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
Summary dbcve.org
An unauthenticated SQL injection exists in Sangoma Switchvox SMB Edition 8.3 in the /pa endpoint. The vulnerability occurs when processing XML content beginning with <PolycomIPPhone>, where the PhoneIP value is directly concatenated into PostgreSQL queries without sanitization or parameterization, allowing arbitrary SQL execution and potential RCE.
Mitigation
Implement parameterized queries (prepared statements) for all database interactions involving user input, particularly the PhoneIP parameter. Apply input validation and consider deploying a WAF rule to block SQL injection attempts until the vendor patch is applied.