CVE-2024-45058: Privilege escalation in i-Educar
i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. Prior to the 2.9 branch, an attacker with only minimal viewing privileges in the settings section is able to change their user type to Administrator (or another type with super-permissions) through a specifically crafted POST request to /intranet/educarusuariocad.php, modifying the nivelusuario parameter. The vulnerability occurs in the file located at ieducar/intranet/educarusuariocad.php, which does not check the user's current permission level before allowing changes. Commit c25910cdf11ab50e50162a49dd44bef544422b6e contains a patch for the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45058?
CVE-2024-45058 has been classified as a high severity vulnerability due to its potential to allow unauthorized privilege escalation.
How do I fix CVE-2024-45058?
To fix CVE-2024-45058, update your i-Educar software to version 2.9 or later which addresses this vulnerability.
Who is affected by CVE-2024-45058?
CVE-2024-45058 affects users of i-Educar software versions prior to 2.9, particularly those with minimal viewing privileges.
What is the impact of CVE-2024-45058?
The impact of CVE-2024-45058 allows an attacker with limited access to escalate their privileges to that of an Administrator.
When was CVE-2024-45058 disclosed?
CVE-2024-45058 was publicly disclosed prior to the release of version 2.9 of the i-Educar software.