CVE-2024-45059: Authenticated SQL Injection in i-Educar
i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A SQL Injection vulnerability was found prior to the 2.9 branch in the ieducar/intranet/funcionariovinculodet.php file, which creates the query by concatenating the unsanitized GET parameter codfunc, allowing the attacker to obtain sensitive information such as emails and password hashes. Commit 7824b95745fa2da6476b9901041d9c854bf52ffe fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45059?
CVE-2024-45059 is classified as a high-severity SQL Injection vulnerability.
How do I fix CVE-2024-45059?
To fix CVE-2024-45059, update your i-Educar software to version 2.9 or later that has patched the vulnerability.
What files are affected by CVE-2024-45059?
CVE-2024-45059 affects the `ieducar/intranet/funcionario_vinculo_det.php` file in the i-Educar software.
Who is impacted by CVE-2024-45059?
Users of i-Educar version 2.9 and below may be impacted by CVE-2024-45059.
How does SQL Injection vulnerability work in CVE-2024-45059?
CVE-2024-45059 allows attackers to manipulate SQL queries through unsanitized input, leading to potential data exposure.