PT-2025-15301 · Jalios · Jalios Jplatform

Arthur Deloffre + 1 · Published 2025-04-07 · Updated 2025-04-08 · CVE-2025-0942

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Jalios JPlatform versions prior to 10.0.6

Description The DB chooser functionality in Jalios JPlatform improperly neutralizes special elements used in an SQL command, allowing authenticated administrative users to trigger SQL Injection. A patch was released on 2023-02-06.

Recommendations For versions prior to 10.0.6, update to version 10.0.6 or apply the PatchPlugin release issued on 2023-02-06 to resolve the issue. As a temporary workaround, consider restricting access to the DB chooser functionality to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-0942

Affected Products

Jalios Jplatform

References · 10

• https://community.jalios.com/patchplugin-10.0.6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-0942 · Security Note
• https://community.jalios.com/jcms/jc2_734797/fr/avertissement-de-securite-2023-02-06 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1909486992921948453 · Twitter Post
• https://t.me/cvedetector/22356 · Telegram Post
• https://t.me/cvetracker/21048 · Telegram Post
• https://vulncheck.com/advisories/jalios-jplatform-record-chooser-sqli · Note
• https://twitter.com/CVEnew/status/1909363139193233437 · Twitter Post
• https://t.me/cvenotify/118387 · Telegram Post
• https://t.me/cvenotify/118127 · Telegram Post