CVE-2025-63694

The vulnerability consists of insufficient validation and sanitization of input data passed to SQL queries in the group management module (explorer/groupmanage). An attacker can inject malicious SQL code into request parameters, resulting in the application executing unintended operations on the database. Due to the network vector (AV:N) and no authentication requirements (PR:N) or user interaction (UI:N), the attack can be conducted remotely by any individual.

An attacker can gain full access to data stored in the database, modify or delete any data, and in favorable configurations also cause a system availability breach. CVSS indicates complete violation of confidentiality, integrity, and availability.

Patches available from the vendor should be applied according to references. As a temporary workaround, it is recommended to restrict network access to the DzzOffice instance to trusted IP addresses only and monitor database queries for anomalies.

DzzOffice version 2.3.7 and all earlier versions.