CVE-2025-10844
📋 TL;DR
This SQL injection vulnerability in Portabilis i-Educar allows attackers to execute arbitrary SQL commands through the /module/Cadastro/aluno endpoint. It affects i-Educar versions up to 2.10, potentially enabling unauthorized data access, modification, or deletion. Remote exploitation is possible, making internet-facing instances particularly vulnerable.
💻 Affected Systems
- Portabilis i-Educar
📦 What is this software?
I Educar by Portabilis
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive student/administrator data exfiltration, credential theft, and potential system takeover via subsequent attacks.
Likely Case
Unauthorized access to student records, grades, and personal information with potential data manipulation or deletion.
If Mitigated
Limited impact with proper input validation, WAF protection, and database permission restrictions in place.
🎯 Exploit Status
Proof of concept is publicly available at the provided GitHub link. Exploitation requires access to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 2.10
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Upgrade i-Educar to version newer than 2.10. 2. Apply input validation and parameterized queries to the /module/Cadastro/aluno endpoint. 3. Review and update database permissions.
🔧 Temporary Workarounds
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns targeting the vulnerable endpoint
Endpoint Restriction
allRestrict access to /module/Cadastro/aluno endpoint to authorized users only
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries for all database interactions
- Apply principle of least privilege to database accounts and restrict network access to the application
🔍 How to Verify
Check if Vulnerable:
Check if i-Educar version is 2.10 or earlier and the /module/Cadastro/aluno endpoint is accessibleCheck Version:
Check application configuration files or admin panel for version informationVerify Fix Applied:
Test the vulnerable endpoint with SQL injection payloads after patching to confirm they are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or parameter manipulation in web logs
Network Indicators:
- SQL injection patterns in HTTP requests to /module/Cadastro/aluno
SIEM Query:
source="web_logs" AND uri="/module/Cadastro/aluno" AND (payload="' OR " OR payload="UNION" OR payload="SELECT")