CVE-2025-5017 is a time-based SQL Injection vulnerability affecting the Catalyst Connect Zoho CRM Client Portal WordPress plugin. The issue exists in the 'uid' parameter due to improper neutralization of special elements in SQL commands, allowing authenticated administrators to inject additional SQL queries. This vulnerability affects all plugin versions up to and including 2.2.0. The CVSS 3.1 base score is 4.9 (medium severity), with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact. No vendor advisory or patch information is currently available, and no known exploits have been reported.

An authenticated attacker with Administrator-level access can exploit this vulnerability to perform time-based SQL Injection via the 'uid' parameter. This allows the attacker to append additional SQL queries to existing ones, potentially extracting sensitive information from the database. The confidentiality of data is impacted, but integrity and availability are not affected. The attack requires high privileges and network access but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to the 'uid' parameter. Avoid exposing the plugin to untrusted administrators. Follow updates from the vendor for any forthcoming patches or mitigations.