8.4
HighCVSS 4.0 · from CERT-PL
CVE-2025-68394
SQL Injection in Protectel
PROTECTELMAJ · SQL injection · CWE-89AffectedPROTECTELMAJ, BDF
FixUpdate to 6.5.19, 6.4.67 or newer
PublishedOct 30, 11:37 · CERT-PL
ScoredOct 30 · 8.4 · CERT-PL
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:06 UTC
What we know
No known exploitation. CISA KEV, checked 22:06 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker has to be on the same network. CVSS: adjacent network.
A successful attack can read data and change data. CVSS impact.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "profilInput" parameter allows for SQL Injection attacks. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67
From CERT-PL
Affected and fixed versions
ProductAffectedFixed inPROTECTELMAJbefore 6.5.196.5.19BDFbefore 6.4.676.4.67
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known