PT-2025-35176 · Unknown · Portabilis I-Educar

Marceloqz · Published 2025-08-29 · Updated 2025-08-29 · CVE-2025-9607

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Portabilis i-Educar versions up to 2.10

Description A flaw exists in Portabilis i-Educar up to version 2.10, related to SQL injection. The issue is located in the /module/TabelaArredondamento/view file within the Tabelas de Arredondamento Page component. Manipulation of the ID argument can trigger the injection. The attack can be launched remotely.

Recommendations Versions prior to 2.10 should be updated. Consider restricting access to the /module/TabelaArredondamento/view file as a temporary workaround. Avoid using the ID parameter in the affected file until the issue is resolved.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-9607

Affected Products

Portabilis I-Educar

References · 9

• 🔥 https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9607.md · Exploit
• 🔥 https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability%20in%20%60id%60%20Parameter%20on%20%60.module.TabelaArredondamento.view%60%20Endpoint.md#poc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9607 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9607 · Vendor Advisory
• https://t.me/CVEtracker/31208 · Telegram Post
• https://vuldb.com/?id.321785 · Note
• https://vuldb.com/?submit.636578 · Note
• https://vuldb.com/?ctiid.321785 · Note
• https://twitter.com/CVEnew/status/1961282391051469085 · Twitter Post