CVE-2025-60267 Details

A SQL injection vulnerability has been identified in the XCKK low-code development platform, specifically in version 9.6. The issue arises in the OaNoticeController.java file, where the 'cond' parameter in the notice/list endpoint is not properly sanitized. This lack of input validation allows attackers to inject malicious SQL queries, potentially leading to unauthorized database access, data manipulation, and leakage of sensitive information.

To address this vulnerability, it is recommended to implement prepared statements and parameter binding to separate SQL code from user input, conduct thorough input validation and filtering to ensure data conforms to expected formats, and minimize database user permissions by using accounts with only the necessary privileges.