High · published November 19, 2025
⚡ An authenticated time-based SQL injection is lurking in versions 2.10.0 and earlier of i-Educar! Imagine having a magic pen that can rewrite grades in a school’s database—sounds powerful, right? 🎓 This vulnerability is like a school administrator receiving a form that directly alters students' grades without proper validation—trusting every request without a second glance can lead to chaos. If an attacker exploits this flaw, they could execute any SQL command they desire, which means they could expose sensitive student data, modify records, or even wipe out critical information from the database. That's a nightmare for any institution!
This vulnerability is like a school administrator receiving a form that directly alters students' grades without proper validation—trusting every request without a second glance can lead to chaos. This SQL injection occurs because the cod_agenda parameter in the agenda.php script is directly concatenated into SQL queries without sufficient sanitization. An attacker with an authenticated session can manipulate this input to run arbitrary SQL commands.
If an attacker exploits this flaw, they could execute any SQL command they desire, which means they could expose sensitive student data, modify records, or even wipe out critical information from the database. That's a nightmare for any institution! To protect against this, immediately update i-Educar to version 2.10.1 or later, where this vulnerability is patched. Additionally, ensure that all input parameters are properly validated and sanitized in the future to prevent similar issues. You've got this! Follow these steps to lock down your school management software and keep those student records secure. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| portabilis/i-educar | ≤ 2.10.0 | — |