CVE-2025-5325 is a medium severity (CVSS 6.3) template injection flaw in the zhilink ADP Application Developer Platform 1.0.0. The testService function of one API path does not neutralise special elements before the template engine uses them. The vendor did not respond and no fix is listed, so restrict access.
What's affected
The record names zhilink ADP Application Developer Platform 1.0.0 and the file path /adpweb/a/ica/api/service/rfa/testService. It says manipulating input leads to improper neutralization of special elements used in a template engine, classified as CWE-1336 and CWE-791.
The record says the attack can be launched remotely, that the exploit has been disclosed to the public, and that the vendor was contacted early but did not respond in any way. The CVSS vector requires low privileges, so an attacker needs an account on the platform first.
No fixed version is named in the record or in the VulDB references. Contact the vendor for a status, and plan around the lack of a patch.
How to check if you're exposed
Find out whether your organisation runs the ADP platform at all. It is a low code application development platform, and instances may sit in a business unit's own hosting. Look for the path named in the record in web server and proxy logs:
grep -r "rfa/testService" /var/log/nginx/ 2>/dev/null
Adjust the log folder to your setup. Requests to that path from addresses you do not know deserve review. Also check whether the platform is reachable from the internet, and which accounts hold low privilege logins that an attacker could obtain.
If you cannot find the product, check with the teams that buy software outside central IT.
What to do now
- Find every ADP platform instance and note its version.
- Ask the vendor for a fixed version or a mitigation, and record the answer.
- Block access to the testService path at your reverse proxy or web application firewall if the function is not needed.
- Remove the platform from the public internet, and reduce the number of accounts that can log in.
- Review logs for requests to the testService path and for unexpected template or server errors.
Why it matters
Template engines turn text with placeholders into output. If user input is placed into the template itself, and not just passed in as data, the engine may evaluate parts of the input as expressions. Depending on the engine, those expressions can read data or call system functions, which is why the weakness can grow into code execution.
A testService function in an API suggests a debugging or integration helper that was left reachable. Such endpoints deserve to be disabled in production. The record gives a medium score because of the low privilege requirement, and the CVE is not on the CISA Known Exploited Vulnerabilities list. The record does state that a public exploit exists, so reachability is what to control.
Quick check
Why is the severity only medium?
The vector in the record requires a low privilege account and rates the impact as low across confidentiality, integrity and availability. Reachability and account control still matter.
Sources
Last reviewed: 18 October 2026.
