PT-2025-23910 · Unknown · 2Clickportal

Kamil Szczurowski + 1 · Published 2025-06-05 · Updated 2025-06-05 · CVE-2025-4568

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions 2ClickPortal versions prior to 7.14.3

Description The issue is related to improper neutralization of input provided by an unauthorized user into the changes reference id parameter in the URL, allowing for boolean-based Blind SQL Injection attacks. This is a result of CWE-89, Improper Neutralization of Special Elements used in an SQL Command, also known as SQL Injection.

Recommendations For 2ClickPortal versions prior to 7.14.3, update to version 7.14.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the changes reference id parameter in the URL to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-4568

Affected Products

2Clickportal

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-4568 · Security Note
• https://twitter.com/CVEnew/status/1930577262669173083 · Twitter Post
• https://t.me/cvenotify/124738 · Telegram Post
• https://2clickportal.pl · Note
• https://cert.pl/en/posts/2025/06/CVE-2025-4568 · Note
• https://t.me/latest_high_impact_cve/2549 · Telegram Post
• https://t.me/cvetracker/25496 · Telegram Post
• https://twitter.com/CveFindCom/status/1930575295737659818 · Twitter Post