PT-2025-51182 · Unknown · Ketr Jepaas

C3P0Ooo_Yiqiyin · CVE-2025-14694 · Published 2025-12-15 · Updated 2025-12-15

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ketr JEPaaS versions up to 7.2.8

Description A flaw exists in ketr JEPaaS that allows for remote SQL injection. The issue is located in the readAllPostil function within the /je/postil/postil/readAllPostil file. Manipulation of the keyWord argument can trigger the injection. The exploit for this issue has been publicly released, and the vendor was notified but did not respond.

Recommendations Versions prior to 7.2.8 should be updated. As a temporary workaround, consider restricting access to the readAllPostil function until a patch is available. Avoid using the keyWord parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-14694

Affected Products

Ketr Jepaas

References · 8

• 🔥 https://github.com/c3p0ooo-Yiqiyin/JEPaaS-readAllPostil-SQL-Injection-Vulnerability/blob/main/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14694 · Security Note
• https://vuldb.com/?id.336412 · Note
• https://twitter.com/CVEnew/status/2000611240801145170 · Twitter Post
• https://t.me/CVEtracker/39790 · Telegram Post
• https://vuldb.com/?ctiid.336412 · Note
• https://t.me/cveNotify/145731 · Telegram Post
• https://vuldb.com/?submit.707178 · Note