{"id":"CVE-2025-68394","kind":"vulnerability","aliases":["CVE-2025-68394"],"related":[],"title":"ARKETEAM Protectel modules: SQL injection via profilInput lets low-privilege users read data","description":"ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into \"profilInput\" parameter allows for SQL Injection attacks.\nThis issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67","summary":"ARKETEAM Protectel modules PROTECTELMAJ and BDF do not neutralize input in the \"profilInput\" parameter, allowing SQL injection. An attacker with a low-privileged account can run arbitrary SQL against the backing database.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PROTECTELMAJ","fixed":["6.5.19"],"affected":"< 6.5.19","ecosystem":"vendor"},{"name":"BDF","fixed":["6.4.67"],"affected":"< 6.4.67","ecosystem":"vendor"}],"ecosystems":[],"tags":["arketeam","auth-required","infrastructure","protectel","self-hosted","sql-injection"],"not_affected_if":["bdf >= 6.4.67","protectelmaj >= 6.5.19","unknown"],"how_to_check":"Check the installed version of each Protectel module: PROTECTELMAJ below 6.5.19 or BDF below 6.4.67 is vulnerable. CERT Polska gives no command or file for this; ask ARKETEAM or look in the admin/about page of your deployment. Any account that can reach the profilInput parameter is a risk.","fix":"- PROTECTELMAJ: move to 6.5.19 or later\n- BDF: move to 6.4.67 or later\nNo workaround is stated by CERT Polska; upgrading is the only remediation named.","status":"open","published_at":"2026-10-30T12:16:33+00:00","first_seen_at":"2026-10-30T12:30:22+00:00","triaged_at":"2026-10-30T12:32:08+00:00","updated_at":"2026-10-30T12:32:31+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-30T12:32:08Z","model":"claude-haiku-5-5","output":{"fix":"- PROTECTELMAJ: move to `6.5.19` or later\n- BDF: move to `6.4.67` or later","reach":"network","title":"ARKETEAM Protectel modules: SQL injection via profilInput lets low-privilege users read data","impact":"high","summary":"ARKETEAM Protectel modules PROTECTELMAJ and BDF do not neutralize input in the \"profilInput\" parameter, allowing SQL injection. An attacker with a low-privileged account can run arbitrary SQL against the backing database.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["protectel","arketeam"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker reads or alters database contents through the profilInput parameter","analyst_note":"Confirm which Protectel deployments expose profilInput and whether the fixed versions are the only remediation; check the NVD entry for the CVSS vector.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000632,"input_tokens":4155,"output_tokens":433,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm which Protectel deployments expose profilInput and whether the fixed versions are the only remediation; check the NVD entry for the CVSS vector.","search":"'-2025':16A,19A '-68394':17A,20A 'account':59B 'allow':49B,93C 'arbitrari':62B 'arketeam':1A,23B,35B,68C 'attack':53B,97C 'auth':25B 'auth-requir':24B 'back':66B 'bdf':22A,40B,73C,107C 'cve':15A,18A 'data':14A 'databas':67B 'fix':102C 'host':31B 'improp':80C 'infrastructur':27B 'inject':5A,34B,51B,78C,96C 'input':44B,83C 'issu':99C 'let':8A 'low':10A,57B,87C 'low-privileg':9A,56B 'modul':3A,37B,70C 'neutral':43B,81C 'paramet':48B,92C 'privileg':11A,58B,88C 'profilinput':7A,47B,91C 'protectel':2A,28B,36B,69C 'protectelmaj':21A,38B,71C,104C 'provid':84C 'read':13A 'requir':26B 'run':61B 'self':30B 'self-host':29B 'sql':4A,33B,50B,63B,77C,95C 'sql-inject':32B 'user':12A,89C 'v6.4.67':108C 'v6.5.19':105C 'via':6A 'vulner':75C,79C","nicknames":[],"mitigations":[],"who_affected":"Organisations (mostly financial institutions doing KYC/KYB checks) that run ARKETEAM Protectel with the PROTECTELMAJ or BDF modules. An attacker needs a low-privileged login, then can inject SQL through the profilInput parameter and read or alter the database. The CVSS 4.0 vector from CERT Polska is adjacent-network (AV:A) and needs high privileges (PR:H), so exposure is mainly internal users. Anyone already on PROTECTELMAJ 6.5.19+ / BDF 6.4.67+ can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-30T12:32:31Z","by":"analyst","doc":"https://cert.pl/en/posts/2026/10/CVE-2025-68391/","run_id":1153},"products":{"at":"2026-10-30T12:32:31Z","by":"analyst","doc":"https://cert.pl/en/posts/2026/10/CVE-2025-68391/","run_id":1153}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-68394","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68394","severity":null,"published_at":"2026-10-30T12:16:33+00:00","modified_at":"2026-10-30T12:16:33+00:00","first_seen_at":"2026-10-30T12:30:22+00:00","fetched_at":"2026-10-30T12:30:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2025-68394:1153","url":null,"severity":null,"published_at":"2026-10-30T12:32:31+00:00","modified_at":"2026-10-30T12:32:31+00:00","first_seen_at":"2026-10-30T12:32:31+00:00","fetched_at":"2026-10-30T12:32:31+00:00","note":"Read CERT Polska advisory (coordinator, not vendor page): versions and fix confirmed; no exploitation or PoC known. CVSS 4.0 8.4 vector shows AV:A/PR:H, so triage's 'low-privilege' framing overstates reach. Sibling CVEs 68391-68395 same fix. No vendor advisory found; how_to_check unverified."}],"documents":[{"id":23430,"url":"https://cert.pl/en/posts/2026/10/CVE-2025-68391/","title":"Vulnerabilities in ARKETEAM Protectel software (CERT Polska)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}