Vulnerability in i-Educar 2.8.0 Allows SQL Injection
CVE-2024-48325

Currently unrated

Key Information:

Vendor

Portabilis

Status
I-educar
Vendor
CVE Published:
6 November 2024

What is CVE-2024-48325?

Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. The "instituicao_id" parameter in "/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id" is not properly sanitized, allowing an unauthenticated remote attacker to inject malicious SQL commands.

References

https://github.com/osvaldotenorio/cve-2024-48325

Timeline

  • Vulnerability published

.