Vulnerability in i-Educar 2.8.0 Allows SQL Injection
CVE-2024-48325

Currently unrated

Key Information:

Vendor

Portabilis

Status
I-educar
Vendor
CVE Published:
6 November 2024

What is CVE-2024-48325?

Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. The "instituicao_id" parameter in "/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id" is not properly sanitized, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/osvaldotenorio/cve-2024-48325

EPSS Score

9% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

JSON
.