Jivejdon EUVD-2025-211053

Exploitation requires an authenticated account holding the Admin role; the attacker must reach the administrative endpoint /admin/user/userListAction and supply a crafted username value that is passed to AccountDaoSql.getAccountByNameLike(). The decisive limiting factor is the PR:H requirement - only administrators can trigger the vulnerable code path, so this is not exploitable by anonymous or low-privilege users and is most relevant as an insider or post-compromise credential-harvesting vector. No special non-default configuration is described beyond having the admin user-management function available; impact is limited to database read (password hash disclosure) with no stated write or availability effect.

This is a genuine but constrained vulnerability - a classic CWE-89 SQL injection, but gated behind the highest privilege level. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H) is internally consistent with the description: network-reachable via the /admin/user/userListAction endpoint, low complexity, but requiring PR:H because only accounts holding the Admin role can reach the vulnerable getAccountByNameLike() path. Confidentiality impact is High (password hash disclosure) while integrity and availability are None, which matches a read-only injection. No EPSS score, KEV listing, or public POC was provided in the intelligence, so there is no signal of active or probable exploitation; the score of 6.9 (Medium) reflects the high privilege prerequisite that sharply limits the realistic attacker population. The practical risk is best read as a privilege-escalation/lateral-movement aid: an attacker who has already compromised an admin account (or a malicious insider) can extract other users' credential hashes, rather than a mass-exploitable remote flaw. Note that PR:H means the attacker already controls the admin role - defenders should weigh this against the raw CVSS number, which overstates urgency for a flaw an attacker can only reach post-authentication as an administrator.

A user who already holds the Admin role (or an attacker who has compromised an admin session) submits crafted input in the username parameter to /admin/user/userListAction, which flows unsanitized into AccountDaoSql.getAccountByNameLike(). By injecting SQL into the LIKE clause, they coerce the query to return arbitrary account rows and dump every user's stored password hashes. No public exploit code is identified at time of analysis, but the injection point is low-complexity once admin access is held.