CVE-2025-71428: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in banq jivejdon

CVE-2025-71428 is an SQL injection vulnerability in banq's Jivejdon product affecting versions up to and including 5.0. The vulnerability exists in the AccountDaoSql.getAccountByNameLike() method, which improperly neutralizes special elements in SQL commands. Authenticated administrators can exploit this by submitting crafted input to the /admin/user/userListAction endpoint, enabling them to read sensitive database information such as other users' password hashes.

An attacker with administrative privileges can exploit this vulnerability to perform SQL injection attacks, potentially exposing sensitive data stored in the database, including password hashes of other user accounts. This could lead to further compromise if password hashes are cracked or used in lateral attacks. The vulnerability requires authenticated admin access, limiting the attack surface to privileged users.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted personnel only and monitor for suspicious activity related to the /admin/user/userListAction endpoint. Avoid using vulnerable versions if possible.