CVE-2025-62319

An attacker injects logical conditions (TRUE or FALSE) into application input fields, thereby manipulating SQL queries executed by the backend. The application does not return direct errors or database data, but responds with different responses depending on whether the injected condition is true or false. Based on differences in application responses, an attacker is able to reconstruct the contents of the database. This allows injection of arbitrary SQL into configuration queries executed within the application.

An attacker can gain unauthorized access to sensitive data stored in the database, as well as compromise its integrity or availability. Depending on the database account permissions, it is possible to read, modify, or delete data.

Apply patches available from the vendor according to the references — detailed information available in the HCL Software knowledge base article: KB0129410 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129410)

HCL Software products indicated in vendor references (article KB0129410); specific versions should be identified based on vendor documentation