Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-59109— Zalktis: SQL injection via partner-controlled fields in imported e-invoices

Quick assessment

Affected
Zalktis Programmas (SIA "Zalktis Programmas") Zalktis
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zalktis 财务应用程序存在 SQL 注入漏洞，攻击者可通过接收到的电子发票中由交易伙伴控制的文本字段发起攻击。在导入接收到的电子发票（UBL/PEPPOL 格式）或执行电子商务导出时，Zalktis 会直接将由交易伙伴控制的值通过字符串拼接方式嵌入到 SQL 语句文本中，既未使用参数化查询，也未进行任何转义处理。尽管应用程序自带一个名为 的转义辅助函数，但在上述代码路径中并未调用该函数。因此，发送电子发票的一方可以突破字符串字面量的限制，篡改查询逻辑，从而实现 SQL 注入攻击。 该漏洞影响 Zalktis

CVSS 8.8 · High EPSS 0.45% · P38

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

VendorProduct Version RangeStatus
Zalktis Programmas (SIA "Zalktis Programmas") Zalktis < 2026.1.586 affected
< 2026.2.592 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-59109

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Zalktis: SQL injection via partner-controlled fields in imported e-invoices
Source: CVE Program / CVE List V5
Vulnerability Description
SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Dazadi.sql_txt(), is not invoked on these code paths, so a party that sends an invoice can break out of the string literal and alter the query logic. This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Zalktis Programmas (SIA "Zalktis Programmas") Zalktis 0 ~ 2026.1.586 -

II. Public POCs for CVE-2026-59109

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-59109

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-59109 (1)

Other References for CVE-2026-59109 (1)

IV. Related Vulnerabilities

Same weakness: CWE-89

V. Comments for CVE-2026-59109

No comments yet

Leave a comment