PT-2025-47474 · I-Educar · I-Educar

Published 2025-11-19 · Updated 2025-11-24 · CVE-2025-65023

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions i-Educar versions prior to 2.10.0

Description i-Educar is school management software. A time-based SQL injection exists in the ieducar/intranet/funcionario vinculo cad.php script for authenticated users. An attacker with an authenticated session can execute arbitrary SQL commands against the application's database. The issue is due to the improper handling of the cod funcionario vinculo GET parameter, which is directly concatenated into an SQL query without proper sanitization.

Recommendations Update i-Educar to a version later than 2.10.0.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-65023

GHSA-8RV6-X8H9-FJFC

Affected Products

I-Educar

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65023.json · Exploit
• 🔥 https://github.com/portabilis/i-educar/security/advisories/GHSA-8rv6-x8h9-fjfc · Exploit
• https://github.com/portabilis/i-educar/commit/a00dfa3f129bc84e27873aa01cbd3f82e5b6c6c8 · Patch
• https://osv.dev/vulnerability/CVE-2025-65023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65023 · Security Note
• https://twitter.com/CVEnew/status/1991187294515261821 · Twitter Post
• https://t.me/cveNotify/143392 · Telegram Post
• https://twitter.com/cracbot/status/1992911139941007384 · Twitter Post
• https://t.me/cveNotify/143470 · Telegram Post