Znuny versions up to 7.3.6 build a ticket-search SQL statement by directly inserting user controlled input into the query. The vulnerability arises because the ContentSearch parameter, which is expected to be either "AND" or "OR", is concatenated with no validation, allowing an attacker to inject arbitrary SQL commands. The resulting flaw is a classic SQL injection (CWE‑89) that can expose, alter, or corrupt database contents and may also lead to denial of service when exploited.

The issue affects the Znuny ticketing system, specifically the modules Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB. All installations running Znuny through version 7.3.6 are vulnerable; no affected versions are listed beyond that point.

The CVSS score of 8.6 indicates a high severity. Although an EPSS score is not available, the lack of input sanitization and the ability to inject arbitrary SQL makes exploitation plausible, especially via the web interface or any API that accepts the ContentSearch parameter. The vulnerability is not currently listed in the CISA KEV catalog, so there is no known active exploitation, but the high impact and broad reach warrant immediate attention.