CVE-2025-71428: Jivejdon SQL Injection Vulnerability

CVE-2025-71428 Overview

CVE-2025-71428 is a SQL injection vulnerability [CWE-89] in Jivejdon through version 5.0. The flaw resides in the AccountDaoSql.getAccountByNameLike() method and is reachable through the /admin/user/userListAction endpoint. Authenticated administrators can inject SQL via the username parameter to read arbitrary database content, including password hashes belonging to other accounts. Exploitation requires the Admin role, which limits the attack surface but still enables lateral movement across the user base once an administrator account is compromised. The issue was published to the National Vulnerability Database (NVD) on 2026-10-08 and documented by VulnCheck.

Critical Impact
Authenticated administrators can extract password hashes and other sensitive data from the Jivejdon database through crafted username input.

Affected Products

Jivejdon through 5.0
AccountDaoSql.getAccountByNameLike() data access method
/admin/user/userListAction administrative endpoint

Discovery Timeline

2026-10-08 - CVE-2025-71428 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2025-71428

Vulnerability Analysis

Jivejdon is a Java-based forum platform maintained in the banq/jivejdon GitHub repository. The administrative user listing feature allows operators to search accounts by partial username. That search path flows into AccountDaoSql.getAccountByNameLike(), which constructs a SQL LIKE query using the untrusted username request parameter. Because the parameter is concatenated into the query string rather than bound as a parameterized value, an attacker with Admin privileges can break out of the string literal and append arbitrary SQL clauses. The result is a classic in-band SQL injection that returns query data in the admin user listing response. Additional context is available in the VulnCheck advisory.

Root Cause

The root cause is unsafe string concatenation inside the data access layer. The vulnerable statement is visible in the AccountDaoSql source. The method accepts the username substring directly from the controller in UserListAction without sanitization or prepared statement binding.

Attack Vector

An authenticated administrator sends a crafted HTTP request to /admin/user/userListAction with a malicious username value. The payload closes the open string in the LIKE clause and appends a UNION SELECT or boolean-based expression that targets the accounts table. The server returns matching records, which may include password hashes and other administrative credentials. See GitHub Issue #24 and GitHub Issue #28 for related discussion.

No verified proof-of-concept code is published for this issue. Refer to the linked source files for the vulnerable code path.

Detection Methods for CVE-2025-71428

Indicators of Compromise

Requests to /admin/user/userListAction containing SQL metacharacters such as single quotes, UNION, SELECT, --, or /* inside the username parameter.
Unusually large response payloads from the admin user listing endpoint, indicating bulk data extraction.
Administrative sessions originating from unexpected IP ranges or user agents immediately before suspicious queries.

Detection Strategies

Enable database query logging and alert on LIKE statements targeting the accounts table that contain unexpected UNION or subquery syntax.
Deploy a web application firewall rule to inspect the username parameter on administrative routes for SQL injection patterns.
Correlate administrator authentication events with subsequent high-volume reads against the accounts table.

Monitoring Recommendations

Monitor the admin user management endpoints for repeated failed queries followed by successful large responses.
Track changes to administrator password hashes and privileged role assignments.
Centralize web and database logs so that injection attempts and resulting query anomalies can be reviewed together.

How to Mitigate CVE-2025-71428

Immediate Actions Required

Restrict access to /admin/user/userListAction to trusted administrative networks using network ACLs or a reverse proxy.
Rotate all administrator passwords and invalidate active admin sessions, since existing hashes may already be exposed.
Audit administrator accounts and remove unused or shared Admin role assignments.

Patch Information

No vendor-published patch is referenced in the available advisories. Monitor the Jivejdon GitHub repository and the VulnCheck advisory for a corrected release. The fix requires replacing the concatenated LIKE query in AccountDaoSql.getAccountByNameLike() with a parameterized PreparedStatement and validating the input length and character set.

Workarounds

Place the application behind a web application firewall configured to block SQL injection payloads targeting the username parameter.
Apply a local source patch that rewrites getAccountByNameLike() to use PreparedStatement.setString() and escapes LIKE wildcards before executing the query.
Disable or restrict the admin user search feature until a vetted fix is deployed.

bash

# Example reverse proxy rule to block common SQL injection tokens
# in the username parameter of the vulnerable endpoint
location /admin/user/userListAction {
    if ($arg_username ~* "('|--|/\*|union|select|or\s+1=1)") {
        return 403;
    }
    proxy_pass http://jivejdon_backend;
}