Protectel 軟體多項漏洞揭露：CVE-2025-68391 及相關安全缺陷
Vulnerabilities in ARKETEAM Protectel software
Protectel 軟體近期被發現多項嚴重漏洞，涵蓋檔案上傳、許可權提升、SQL 注入與 XSS 等攻擊面向。
此報告揭示 Protectel 軟體多項嚴重漏洞，提醒使用者及管理者即時升級以防止遠端執行及注入攻擊，並列出已修補版本，供系統管理員快速核對。
Vulnerabilities in ARKETEAM Protectel software
| CVE ID | CVE-2025-68391 |
| Publication date | 30 October 2026 |
| Vendor | ARKETEAM |
| Product | Protectel (modules PROTECTELMAJ and BDF) |
| Vulnerable versions | All before 6.5.19 (PROTECTELMAJ) All before 6.4.67 (BDF) |
| Vulnerability type (CWE) | Unrestricted Upload of File with Dangerous Type (CWE-434) |
| Report source | Report to CERT Polska |
| CVE ID | CVE-2025-68392 |
| Publication date | 30 October 2026 |
| Vendor | ARKETEAM |
| Product | Protectel (modules PROTECTELMAJ and BDF) |
| Vulnerable versions | All before 6.5.19 (PROTECTELMAJ) All before 6.4.67 (BDF) |
| Vulnerability type (CWE) | Incorrect Authorization (CWE-863) |
| Report source | Report to CERT Polska |
| CVE ID | CVE-2025-68393 |
| Publication date | 30 October 2026 |
| Vendor | ARKETEAM |
| Product | Protectel (modules PROTECTELMAJ and BDF) |
| Vulnerable versions | All before 6.5.19 (PROTECTELMAJ) All before 6.4.67 (BDF) |
| Vulnerability type (CWE) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) |
| Report source | Report to CERT Polska |
| CVE ID | CVE-2025-68394 |
| Publication date | 30 October 2026 |
| Vendor | ARKETEAM |
| Product | Protectel (modules PROTECTELMAJ and BDF) |
| Vulnerable versions | All before 6.5.19 (PROTECTELMAJ) All before 6.4.67 (BDF) |
| Vulnerability type (CWE) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) |
| Report source | Report to CERT Polska |
| CVE ID | CVE-2025-68395 |
| Publication date | 30 October 2026 |
| Vendor | ARKETEAM |
| Product | Protectel (modules PROTECTELMAJ and BDF) |
| Vulnerable versions | All before 6.5.19 (PROTECTELMAJ) All before 6.4.67 (BDF) |
| Vulnerability type (CWE) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (CWE-79) |
| Report source | Report to CERT Polska |
Description
CERT Polska has received a report about vulnerabilities in ARKETEAM Protectel software and participated in coordination of their disclosure.
The vulnerability CVE-2025-68391: ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to download the uploaded file.
The vulnerability CVE-2025-68392: ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by forging direct requests to a specific endpoint.
The vulnerability CVE-2025-68393: ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into Utilisateur parameter allows for SQL Injection attacks.
The vulnerability CVE-2025-68394: ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into profilInput parameter allows for SQL Injection attacks.
The vulnerability CVE-2025-68395: ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module.
These issues have been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67
Credits
We thank Karol Miring for the responsible vulnerability report.
More about the coordinated vulnerability disclosure process at CERT Polska can be found at https://cert.pl/en/cvd/.