Kobikom KobiPBX: SQL injection vulnerability (CVE-2026-105321)
An SQL injection vulnerability exists in Kobikom KobiPBX versions prior to r1, allowing attackers to inject arbitrary SQL commands into the backend database.
CVE search metadata
CVE search record: CVE-2026-105321. Severity: high. CVSS: 7.5. KEV: no. Product: KobiPBX-FOP3-SEC (< r1). Brief: Kobikom KobiPBX: SQL injection vulnerability (CVE-2026-105321). Brief link: https://feed.craftedsignal.io/briefs/2026-11-kobikom-sqli/
Triage facts
Revision 1- Applicability
- KobiPBX-FOP3-SEC (< r1)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 5, 14:41 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Kobikom Telecommunications and Informatics Services Inc. has disclosed an improper neutralization of special elements used in an SQL command (SQL injection) vulnerability within its KobiPBX product. The flaw exists in versions prior to KobiPBX-FOP3-SEC-r1. Exploitation could allow an attacker to perform unauthorized database actions, such as data retrieval or modification.
Impact
Successful exploitation allows for unauthorized interaction with the backend database. While specific impact is not documented, SQL injection typically permits data exfiltration, database manipulation, or authentication bypass.
Recommendation
- Inventory all instances of Kobikom KobiPBX within the network to identify versions below KobiPBX-FOP3-SEC-r1.
- Upgrade all affected KobiPBX installations to the secure release (KobiPBX-FOP3-SEC-r1) or newer immediately.
- Until patching is complete, restrict access to the web management interface of KobiPBX to authorized internal management networks only.
Immediate actions
Upgrade KobiPBX-FOP3-SEC to r1 or later
Threat Hunt
Monitor web access logs for common SQL injection patterns targeting KobiPBX management interfaces
Data: Web server access logs
Mitigations
Upgrade to KobiPBX-FOP3-SEC-r1
CVE-2026-105321