Live › vulnerability › CVE-2025-68394
ARKETEAM Protectel modules PROTECTELMAJ and BDF do not neutralize input in the "profilInput" parameter, allowing SQL injection. An attacker with a low-privileged account can run arbitrary SQL against the backing database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Organisations (mostly financial institutions doing KYC/KYB checks) that run ARKETEAM Protectel with the PROTECTELMAJ or BDF modules. An attacker needs a low-privileged login, then can inject SQL through the profilInput parameter and read or alter the database. The CVSS 4.0 vector from CERT Polska is adjacent-network (AV:A) and needs high privileges (PR:H), so exposure is mainly internal users. Anyone already on PROTECTELMAJ 6.5.19+ / BDF 6.4.67+ can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| PROTECTELMAJ | vendor | < 6.5.19 | 6.5.19 |
| BDF | vendor | < 6.4.67 | 6.4.67 |
6.5.19 or BDF below 6.4.67 is vulnerableEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "profilInput" parameter allows for SQL Injection attacks. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67
This page as .md · .json · in your agent: get_signal("CVE-2025-68394")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.