ARKETEAM Protectel modules affected by SQL injection (EUVD-2025-211225)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- ARKETEAM
- Product
- PROTECTELMAJ, BDF
- First seen
Summary
EUVD-2025-211225 describes an SQL injection flaw in the ARKETEAM Protectel PROTECTELMAJ and BDF modules, scored 8.4 under CVSS v3.1. The entry is published by ENISA's European Vulnerability Database and is reported here without independent verification.
If you use ARKETEAM
Check whether PROTECTELMAJ or BDF is deployed in your environment
Apply a vendor fix or restrict access to the 'Utilisateur' parameter until one is available
Limit low-privileged account access to the affected modules
Apply a vendor fix or restrict access to the 'profilInput' parameter until one is available
Apply a vendor fix when available
Restrict note-creation rights to trusted users
What the sources say 5
· Mastodon: “ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS.” Source
· Mastodon: “ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability.” Source
· Mastodon: “ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability.” Source
· Mastodon: “ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by forging direct requests to a specific endpoint.” Source
· Mastodon: “ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload.” Source