CVE-2024-45059

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A SQL Injection vulnerability was found prior to the 2.9 branch in the `ieducar/intranet/funcionario_vinculo_det.php` file, which creates the query by concatenating the unsanitized GET parameter `cod_func`, allowing the attacker to obtain sensitive information such as emails and password hashes. Commit 7824b95745fa2da6476b9901041d9c854bf52ffe fixes the issue.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0

8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.66% chance of exploitation in the next 30 days, 49th percentile

Published

2024-08-28

Updated

2024-09-06

Proof-of-concept exploits (1)

• portabilis/i-educar/security/advisories/GHSA-2v4w-7xqr-hxmr

References

• CVE Record
• NVD entry

Related

• CVE-2024-45057
• CVE-2024-45058
• CVE-2024-55651
• CVE-2024-4506
• CVE-2024-45060
• CVE-2024-45053