PT-2025-47475 · I-Educar · I-Educar

Published 2025-11-19 · Updated 2025-11-24 · CVE-2025-65024

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions i-Educar versions prior to 2.10.0

Description i-Educar is school management software with a flaw that allows an authenticated attacker to execute arbitrary SQL commands against the application's database. This is due to a time-based SQL injection in the ieducar/intranet/agenda admin cad.php script. The issue stems from the improper handling of the cod agenda GET parameter, which is directly incorporated into an SQL query without sufficient sanitization.

Recommendations Update i-Educar to a version later than 2.10.0.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-65024

GHSA-6C8P-XQCV-RGHX

Affected Products

I-Educar

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65024.json · Exploit
• https://github.com/portabilis/i-educar/security/advisories/GHSA-6c8p-xqcv-rghx · Vendor Advisory
• https://github.com/portabilis/i-educar/commit/3e9763a561b328edaed21a7dc2e0dba0bbbc6e22 · Patch
• https://osv.dev/vulnerability/CVE-2025-65024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65024 · Security Note
• https://t.me/cveNotify/143471 · Telegram Post
• https://twitter.com/CVEnew/status/1991187295647785223 · Twitter Post
• https://twitter.com/cracbot/status/1992911141782299006 · Twitter Post