CVE-2025-71428 Details
Description
Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents, including other accounts' password hashes.
A SQL injection vulnerability has been identified in Jivejdon versions through 5.0, specifically within the 'getAccountByNameLike' method of the 'AccountDaoSql' class. This vulnerability allows authenticated administrators to inject malicious SQL through the username parameter. Exploitation of this flaw could lead to unauthorized access to database contents, including sensitive information such as password hashes of other accounts.
The vulnerability can be addressed by modifying the 'getAccountByNameLike' method to use parameterized queries instead of concatenating user input directly into SQL statements. Additionally, implementing input validation to sanitize the username parameter and ensure only safe characters are allowed can help prevent SQL injection attacks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/banq/jivejdon | [email protected] | Vendor |
| https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/infrastructure/repository/dao/sql/AccountDaoSql.java#L329-L335 | [email protected] | Source CodeVendor |
| https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/presentation/action/admin/UserListAction.java#L13-L24 | [email protected] | Source CodeVendor |
| https://github.com/banq/jivejdon/issues/24 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/banq/jivejdon/issues/28 | [email protected] | BundleIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/jivejdon-through-5.0-sql-injection-via-username-in-userlistaction | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| banq Jivejdon | <= 5.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Translated | [email protected] |
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |