SQL Injection in Portabilis I-educar
CVE-2024-45059
i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A SQL Injection vulnerability was found prior to the 2.9 branch in the `ieducar/intranet/funcionar…
Vulnerability class: SQL Injection
EPSS: 0.001 (34.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Portabilis I-educar — versions < 2.9
Weakness classification (CWE)
References
- https://github.com/portabilis/i-educar/security/advisories/GHSA-2v4w-7xqr-hxmr (x_refsource_CONFIRM)
- https://github.com/portabilis/i-educar/commit/7824b95745fa2da6476b9901041d9c854bf52ffe (x_refsource_MISC)
- https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html (x_refsource_MISC)
- https://portswigger.net/web-security/sql-injection (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-45059?
- CVE-2024-45059 is a high-severity vulnerability in Portabilis I-educar, classified under SQL Injection. CVSS score: 8.8/10. Published 2024-08-28.
- How severe is CVE-2024-45059?
- High severity. CVSS v3 base score is 8.8 out of 10.