| Título | Portabilis i-Educar 2.10 SQL Injection |
|---|
| Descripción | SQL Injection (Boolean-Based) Vulnerability in id Parameter on module/ComponenteCurricular/edit Endpoint
Summary
A SQL Injection vulnerability was identified in the /module/ComponenteCurricular/edit endpoint of the i-educar application, specifically in the id parameter. This vulnerability allows attackers to execute arbitrary SQL commands on the backend database, potentially compromising the confidentiality, integrity, and availability of application data.
Details
Vulnerable Endpoint: /module/ComponenteCurricular/edit
Parameter: id
The application fails to properly validate and sanitize user input in the id parameter. As a result, attackers can inject crafted SQL payloads that are executed directly by the database. This could allow database enumeration, data exfiltration, modification, or denial of service via time-based delays.
PoC
Step by Step:
Install sqlmap tool and type the command below:
Payload:
sqlmap -u "http://localhost:8086/module/ComponenteCurricular/edit?id=8" --cookie="i_educar_session=bnTu3HZ4Jk5a0JxRERNMd03ZAr1TUGvXZTDs9DdE" --batch --dbs --dbms=postgresql
sqlmap begins to test a lot of SQLi in id parameter until find a boolean-based blind:
image 1: https://github.com/KarinaGante/KG-Sec/raw/main/CVEs/images/SQLi18.png
Some time after, sqlmap will enumerate available databases confirming that SQL Injection:
image 2: https://github.com/KarinaGante/KG-Sec/raw/main/CVEs/images/SQLi19.png
Impact
Unauthorized data access: Reading sensitive information such as credentials, personal data, or configuration details
Database enumeration: Extracting database schema, tables, and column details
Data manipulation: Adding, modifying, or deleting database records.
Denial of Service (DoS): Using time-based queries to impact system availability.
Potential escalation to RCE: If combined with other vulnerabilities and specific database features.
Finder
Discovered by Karina Gante. |
|---|
| Fuente | ⚠️ https://github.com/KarinaGante/KG-Sec/blob/main/CVEs/i-Educar/27.md |
|---|
| Usuario | karinagante (UID 88113) |
|---|
| Sumisión | 2025-09-18 01:56 (hace 1 Año) |
|---|
| Moderación | 2025-09-22 07:35 (4 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 325208 [Portabilis i-Educar hasta 2.10 edit id inyección SQL] |
|---|
| Puntos | 20 |
|---|