Home

Description

The DB chooser functionality in Jalios JPlatform 10 SP6 before 10.0.6 improperly neutralizes special elements used in an SQL command allows for unauthenticated users to trigger SQL Injection. This issue affects JPlatform before 10.0.6 and a PatchPlugin release 10.0.6 was issued 2023-02-06.

PUBLISHED Reserved 2025-01-31 | Published 2025-04-07 | Updated 2025-11-19 | Assigner VulnCheck




HIGH: 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
affected

Any version before 10.0.6
affected

Credits

Arthur Deloffre (Vozec) finder

Tristan Bizien (Bizi) finder

References

community.jalios.com/...avertissement-de-securite-2023-02-06 vendor-advisory

community.jalios.com/patchplugin-10.0.6 patch

www.vulncheck.com/...es/jalios-jplatform-record-chooser-sqli third-party-advisory

cve.org (CVE-2025-0942)

nvd.nist.gov (CVE-2025-0942)

Download JSON