Jivejdon version 5.0 contains a SQL injection flaw in the AccountDaoSql.getAccountByNameLike method, which is called by the /admin/user/userListAction endpoint. When an authenticated user with the Admin role supplies crafted data in the username field, the application concatenates the input directly into a SQL query, allowing arbitrary SQL commands to execute. The vulnerability can be leveraged to read arbitrary database tables, including the passwords table, exposing sensitive credentials and enabling account compromise. This weakness aligns with CWE‑89, representing attackers’ ability to inject malicious SQL statements.

Banq’s Jivejdon forum software, versions up to and including 5.0, is affected. The flaw is present in the core repository code located in AccountDaoSql. Any installation running Jivejdon 5.0 or earlier while exposing the default admin interface is vulnerable.

The publicly disclosed CVSS score of 6.9 reflects a moderate severity due to the need for administrative authentication. No EPSS score is available, and the vulnerability is not currently listed in the CISA KEV catalog. The attack requires prior admin access, which typically limits the threat to internal attackers or compromised administrator credentials. Nonetheless, because the flaw permits arbitrary data extraction, an attacker who gains sufficient privileges can obtain password hashes and potentially use them to further compromise user accounts or the system.