| 标题 | Portabilis i-Educar 2.10.0 SQL Injection |
|---|
| 描述 |
Summary
The deletar parameter in the agenda.php page of the i-Educar system is vulnerable to time-based blind SQL injection. An attacker can craft a malicious request that manipulates the SQL logic and introduces delays via pg_sleep() — thereby proving code execution in the backend PostgreSQL database.
This vulnerability allows unauthenticated attackers to exploit the application in a stealthy and reliable way, potentially leading to data exfiltration or full compromise of the backend logic.
Technical Details
Vulnerable Request:
GET /intranet/agenda.php?cod_agenda=2&time=1769548041&deletar=1' AND (SELECT 1 FROM pg_sleep(3)) IS NULL AND 'a'='a HTTP/1.1
Host: localhost
Cookie: i_educar_session=oPSWZGZAoaklSkX60cVXos50m3HfqrO8VW8PC0KW
Time delay using pg_sleep(10):
GET /intranet/agenda.php?cod_agenda=2&time=1769548041&deletar=1'%20AND%20(SELECT%201%20FROM%20pg_sleep(10))%20IS%20NULL%20AND%20'a'%3D'a
The parameter deletar is concatenated directly into a SQL statement.
The payload injects a subquery using PostgreSQL’s pg_sleep(3) function.
When executed, this causes the SQL server to intentionally delay the response.
By measuring the time difference between requests, it is possible to infer boolean conditions and exfiltrate sensitive data bit by bit.
This vulnerability is similar to https://github.com/portabilis/i-educar/security/advisories/GHSA-4hrj-5gwx-r4w4, but as you can see in the POC, it's on a different endpoint. It looks like the developers corrected the cod_agenda parameter but not the deletar parameter. |
|---|
| 来源 | ⚠️ https://github.com/natanmorette-thoropass/Thoropass-VRP/blob/main/2026/Time-Based%20Blind%20SQL%20Injection%20in%20i-Educar%20(deleta/Time-Based%20Blind%20SQL%20Injection%20in%20i-Educar%20(deleta%202f5ef09b873680b28f88cdbbf8686cb0.md |
|---|
| 用户 | Anonymous User |
|---|
| 提交 | 2026-01-29 14時24分 (8 月前) |
|---|
| 管理 | 2026-02-07 11時32分 (9 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 321550 [Portabilis i-Educar 直到 2.10 Agenda /intranet/agenda.php cod_agenda SQL注入] |
|---|
| 积分 | 0 |
|---|