ARKETEAM Protectel EUVD-2025-211225

Exploitation requires an authenticated low-privileged user account on the affected ARKETEAM Protectel module (PROTECTELMAJ before v6.5.19 or BDF before v6.4.67) and, per the CVSS vector, adjacent-network reachability (AV:A) rather than arbitrary internet access. The concrete trigger is unsanitized input supplied through the "Utilisateur" parameter. Limiting factors: it is not remote-unauthenticated (an account is needed), the attacker must reach the application over the adjacent/local network segment, and only these two niche modules in the stated version ranges are affected. Note the input CVSS encodes PR:H while the description says the required account is low-privileged; the privilege bar should be confirmed with the vendor.

This is a CWE-89 SQL injection in the ARKETEAM Protectel modules PROTECTELMAJ and BDF, reachable through the "Utilisateur" parameter. The CNA-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L, base 8.4) describes an adjacent-network, low-complexity attack with high confidentiality and integrity impact. A clear signal conflict exists: the CVSS vector encodes PR:H (high privileges required), yet the description explicitly states the flaw is triggered by input from a "low privileged user" - these disagree, and the description's lower bar is the more exploit-relevant of the two; verify the true privilege requirement with the vendor/CERT-PL advisory. On the decision side, the input carries a vuln.today priority of "this_week" and a vendor patch is available, but there is no EPSS probability, no CISA KEV listing, and no public exploit or PoC reference supplied. So while the technical impact is high (full read/write of the backing database typical of SQLi), the real-world urgency signals are moderate rather than critical: no evidence of active exploitation and no published exploit code, against a niche vendor product. Net: a genuine high-impact, patch-now-this-week issue for anyone running these modules, but not an emergency mass-exploitation scenario based on the available signals.

An attacker with a low-privileged account on the Protectel application, positioned on the adjacent network, submits crafted input in the "Utilisateur" parameter that is not properly neutralized before being used in a SQL query. This lets them read or modify arbitrary database contents (credentials, business records) belonging to other users. No public exploit code or PoC was identified in the provided sources.