Description

CERT Polska has received a report about vulnerabilities in ARKETEAM Protectel software and participated in coordination of their disclosure.

The vulnerability CVE-2025-68391: ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to download the uploaded file.

The vulnerability CVE-2025-68392: ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by forging direct requests to a specific endpoint.

The vulnerability CVE-2025-68393: ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into Utilisateur parameter allows for SQL Injection attacks.

The vulnerability CVE-2025-68394: ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into profilInput parameter allows for SQL Injection attacks.

The vulnerability CVE-2025-68395: ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module.

These issues have been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67

Credits

We thank Karol Miring for the responsible vulnerability report.