CVE-2025-14190: Chanjet TPlus sql injection
A flaw has been found in Chanjet TPlus up to 20251121. Affected by this vulnerability is an unknown functionality of the file /tplus/ajaxpro/Ufida.T.SM.UIP.MultiCompanySettingController,Ufida.T.SM.UIP.ashx?method=Load. This manipulation of the argument currentAccId causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14190?
CVE-2025-14190 has a high severity due to the potential for SQL injection exploitation.
How do I fix CVE-2025-14190?
To mitigate CVE-2025-14190, update Chanjet TPlus to a version released after 20251121 which addresses this vulnerability.
What impact does CVE-2025-14190 have on my system?
CVE-2025-14190 could allow an attacker to execute arbitrary SQL queries, potentially leading to data leakage or corruption.
Which versions of Chanjet TPlus are affected by CVE-2025-14190?
Chanjet TPlus versions up to and including 20251121 are affected by CVE-2025-14190.
Is there a known exploit for CVE-2025-14190?
Yes, there is a well-documented method for exploiting CVE-2025-14190 through manipulation of the currentAccId parameter.