CVE-2025-0942 | THREATINT

Description

The DB chooser functionality in Jalios JPlatform 10 SP6 before 10.0.6 improperly neutralizes special elements used in an SQL command allows for unauthenticated users to trigger SQL Injection. This issue affects JPlatform before 10.0.6 and a PatchPlugin release 10.0.6 was issued 2023-02-06.

Reserved 2025-01-31 | Published 2025-04-07 | Updated 2025-04-14 | Assigner VulnCheck

HIGH: 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status

affected

Any version before 10.0.6

affected

Credits

Arthur Deloffre (Vozec) finder

Tristan Bizien (Bizi) finder

References

community.jalios.com/...avertissement-de-securite-2023-02-06 vendor-advisory

community.jalios.com/patchplugin-10.0.6 patch

cve.org (CVE-2025-0942)

nvd.nist.gov (CVE-2025-0942)

Download JSON