The vulnerability is a classic SQL injection flaw that occurs when input supplied by a low privileged user to the 'Utilisateur' parameter is not properly neutralized. An attacker can inject arbitrary SQL statements, potentially leading to unauthorized data exfiltration, data modification or other database compromise activities. The flaw directly enables the execution of malicious SQL against the underlying database and is not limited to read operations.

ARKETEAM Protectel modules PROTECTELMAJ and BDF are affected. Versions before PROTECTELMAJ 6.5.19 and BDF 6.4.67 are vulnerable and should be upgraded. Other applications that embed these modules should be checked for the same input handling issues.

The CVSS score of 8.4 indicates a high severity vulnerability. No EPSS score is available, so current exploitation likelihood is undetermined, but SQL injection is a well‑known attack vector often exploited. The issue is not listed in the CISA KEV catalog. An exploit requires only a low privileged user who can reach the interface that accepts the 'Utilisateur' parameter – no additional privileges or remote code execution capabilities are required for an initial compromise.