PT-2025-47473 · I-Educar · I-Educar

Published 2025-11-19 · Updated 2025-11-24 · CVE-2025-65022

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions i-Educar versions prior to 2.10.0

Description i-Educar is school management software with a flaw that allows an authenticated attacker to execute arbitrary SQL commands against the application's database. This is due to improper handling of the cod agenda request parameter in the ieducar/intranet/agenda.php script, which is directly concatenated into SQL queries without sufficient sanitization. The vulnerability is a time-based SQL injection.

Recommendations Update i-Educar to a version later than 2.10.0.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-65022

GHSA-4HRJ-5GWX-R4W4

Affected Products

I-Educar

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65022.json · Exploit
• https://github.com/portabilis/i-educar/commit/b473f92b5326f45d7bce2de93a5381bed7ca8ac7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-65022 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65022 · Vendor Advisory
• https://github.com/portabilis/i-educar/security/advisories/GHSA-4hrj-5gwx-r4w4 · Note
• https://t.me/cveNotify/143391 · Telegram Post
• https://t.me/cveNotify/143469 · Telegram Post
• https://twitter.com/cracbot/status/1992911138108101032 · Twitter Post
• https://twitter.com/CVEnew/status/1991187293496046044 · Twitter Post