Vulnerability Overview: CVE-2025-4568 in 2Clickportal
CVE Identifier: CVE-2025-4568
Publication Date: June 5, 2025
Vendor: Trol Intermedia
Product: 2Clickportal
Vulnerable Versions: All versions prior to 7.14.3
Vulnerability Type (CWE): Improper Neutralization of Special Elements Used in an SQL Command (‘SQL Injection’) (CWE-89)
Source of Report: Reported to CERT Polska
Description of the Vulnerability
CERT Polska has received notification regarding a vulnerability in Trol Intermedia’s 2Clickportal software, actively participating in the coordination efforts for its disclosure. The identified vulnerability, CVE-2025-4568, involves improper neutralization of input provided by unauthorized users. Specifically, the issue resides in the changes__Reference_id parameter within the URL, which opens the possibility for blind SQL injection attacks based on boolean logic.
SQL injection vulnerabilities, particularly those categorized as "blind," allow attackers to manipulate the SQL queries that are executed against a database by injecting malicious SQL code through input fields or parameters. In this case, the vulnerability could be exploited by crafting specific URLs that manipulate the changes__Reference_id parameter to extract sensitive information or possibly alter the underlying database structure.
The 2Clickportal software had several versions susceptible to this attack, making it a critical issue for any operations depending on versions prior to 7.14.3. Attackers exploiting this vulnerability could potentially access sensitive data, compromise data integrity, and perform unauthorized actions on the database.
Mitigation
The vulnerability has been addressed and resolved in version 7.14.3 of the 2Clickportal software. Users and organizations utilizing 2Clickportal are urged to update to this version to ensure their systems are safeguarded against potential SQL injection attacks stemming from CVE-2025-4568. Continuous vigilance in monitoring and updating software is crucial to prevent exploitation of known vulnerabilities.
Acknowledgments
Acknowledgments are extended to Kamil Szczurowski and Robert Kruczek for their responsible reporting of this issue, which facilitated its timely disclosure and remediation.
Further Information
For more detailed guidance regarding the vulnerability disclosure process and other related resources, you can visit CERT Polska’s official website at https://cert.pl/en/cvd/.
Maintaining up-to-date software versions and employing best practices for input validation and sanitation can greatly reduce risks associated with SQL injection vulnerabilities. Organizations are encouraged to conduct regular security audits and implement comprehensive security measures to mitigate the impact of such vulnerabilities in their systems.