CVE-2025-60785: Remote Code Execution Via JDBC Injection On IceScrum

Vulnerability Details

The testDbConnection HTTP endpoint accepts a user-supplied JDBC connection string. When used with a vulnerable PostgreSQL JDBC driver present in the application, specially crafted JDBC connection strings can trigger remote code execution on the server. The endpoint lacks proper CSRF protections, allowing an unauthenticated attacker to coerce an authenticated user (or an administrative browser context) into submitting the malicious JDBC string with a single click — resulting in server-side remote code execution with the privileges of the running process.

Proof of Concept

The exploit POC can can be found at : POC.py

Affected Versions

This vulnerability affects IceScrum versions ≤ 7.5.4 . Organizations using affected versions should immediately apply security patches.

References

• CVE.ORG

This research was conducted by the ZDaylabs security team as part of our ongoing commitment to improving application security.