NIST AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NIST CWE-89

OR
     *cpe:2.3:a:portabilis:i-educar:*:*:*:*:*:*:*:* versions up to (including) 2.9

https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html No Types Assigned

https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html Technical Description

https://github.com/portabilis/i-educar/commit/7824b95745fa2da6476b9901041d9c854bf52ffe No Types Assigned

https://github.com/portabilis/i-educar/commit/7824b95745fa2da6476b9901041d9c854bf52ffe Patch

https://github.com/portabilis/i-educar/security/advisories/GHSA-2v4w-7xqr-hxmr No Types Assigned

https://github.com/portabilis/i-educar/security/advisories/GHSA-2v4w-7xqr-hxmr Exploit, Third Party Advisory

https://portswigger.net/web-security/sql-injection No Types Assigned

https://portswigger.net/web-security/sql-injection Technical Description

i-Educar is free, completely online school management software that allows school secretaries, teachers, coordinators and area managers. In affected versions Creating a SQL query from a concatenation of a user-controlled GET parameter allows an attacker to manipulate the query. Successful exploitation of this flaw allows an attacker to have complete and unrestricted access to the database, with a web user with minimal permissions. This may involve obtaining user information, such as emails, pass

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A SQL Injection vulnerability was found prior to the 2.9 branch in the `ieducar/intranet/funcionario_vinculo_det.php` file, which creates the query by concatenating the unsanitized GET parameter `cod_func`, allowing the attacker to obtain sensitive information such as emails and password hashes. Commit 7824b95745fa2da6476b9901041d9c854bf52ffe fixes the issu

GitHub, Inc. https://github.com/portabilis/i-educar/commit/7824b95745fa2da6476b9901041d9c854bf52ffe [No types assigned]

i-Educar is free, completely online school management software that allows school secretaries, teachers, coordinators and area managers. In affected versions Creating a SQL query from a concatenation of a user-controlled GET parameter allows an attacker to manipulate the query. Successful exploitation of this flaw allows an attacker to have complete and unrestricted access to the database, with a web user with minimal permissions. This may involve obtaining user information, such as emails, pass

GitHub, Inc. AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

GitHub, Inc. CWE-89

GitHub, Inc. https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html [No types assigned]

GitHub, Inc. https://github.com/portabilis/i-educar/security/advisories/GHSA-2v4w-7xqr-hxmr [No types assigned]

GitHub, Inc. https://portswigger.net/web-security/sql-injection [No types assigned]