Sangoma Switchvox SMB Edition vulnerabilities

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality. The submit_modify_voicemail_template endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious JavaScript to be stored server-side and rendered to other users.

An unauthenticated reflected XSS vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to sanitize the 'portal' parameter in invalid_browser and invalid_browser_login handlers, allowing attacker-controlled script execution in a victim's browser.