---
id: "CVE-2025-68394"
kind: "vulnerability"
aliases: ["CVE-2025-68394"]
title: "ARKETEAM Protectel modules: SQL injection via profilInput lets low-privilege users read data"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "PROTECTELMAJ", "fixed": ["6.5.19"], "affected": "< 6.5.19", "ecosystem": "vendor"}, {"name": "BDF", "fixed": ["6.4.67"], "affected": "< 6.4.67", "ecosystem": "vendor"}]
ecosystems: []
tags: ["arketeam", "auth-required", "infrastructure", "protectel", "self-hosted", "sql-injection"]
not_affected_if: ["bdf >= 6.4.67", "protectelmaj >= 6.5.19", "unknown"]
published_at: "2026-10-30T12:16:33+00:00"
first_seen_at: "2026-10-30T12:30:22+00:00"
updated_at: "2026-10-30T12:32:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68394", "first_seen_at": "2026-10-30T12:30:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T12:32:31+00:00"}]
---

# ARKETEAM Protectel modules: SQL injection via profilInput lets low-privilege users read data

ARKETEAM Protectel modules PROTECTELMAJ and BDF do not neutralize input in the "profilInput" parameter, allowing SQL injection. An attacker with a low-privileged account can run arbitrary SQL against the backing database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:PROTECTELMAJ affected < 6.5.19 fixed 6.5.19
- vendor:BDF affected < 6.4.67 fixed 6.4.67

## How to check

Check the installed version of each Protectel module: PROTECTELMAJ below 6.5.19 or BDF below 6.4.67 is vulnerable. CERT Polska gives no command or file for this; ask ARKETEAM or look in the admin/about page of your deployment. Any account that can reach the profilInput parameter is a risk.

## Fix

- PROTECTELMAJ: move to 6.5.19 or later
- BDF: move to 6.4.67 or later
No workaround is stated by CERT Polska; upgrading is the only remediation named.

## Timeline

- 2026-10-30T12:30:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-68394
- 2026-10-30T12:32:31+00:00 analyst — Read CERT Polska advisory (coordinator, not vendor page): versions and fix confirmed; no exploitation or PoC known. CVSS 4.0 8.4 vector shows AV:A/PR:H, so triage's 'low-privilege' framing overstates reach. Sibling CVEs 68391-68395 same fix. No vendor advisory found; how_to_check unverified.

## Documents

- [advisory] Vulnerabilities in ARKETEAM Protectel software (CERT Polska) https://cert.pl/en/posts/2026/10/CVE-2025-68391/

## From the sources

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "profilInput" parameter allows for SQL Injection attacks.
This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_