Vulnerabilities in ARKETEAM Protectel software

CERT Polska has received a report about vulnerabilities in ARKETEAM Protectel software and participated in coordination of their disclosure.

The vulnerabilityCVE-2025-68391: ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to download the uploaded file.

The vulnerabilityCVE-2025-68392: ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by forging direct requests to a specific endpoint.

The vulnerabilityCVE-2025-68393: ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user intoUtilisateurparameter allows for SQL Injection attacks.

The vulnerabilityCVE-2025-68394: ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user intoprofilInputparameter allows for SQL Injection attacks.

The vulnerabilityCVE-2025-68395: ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module.

These issues have been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67

We thank Karol Miring for the responsible vulnerability report.