CVE-2024-48325: SQL Injection
Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. The "instituicaoid" parameter in "/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicaoid" is not properly sanitized, allowing an unauthenticated remote attacker to inject malicious SQL commands.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-48325?
CVE-2024-48325 is classified as a high-severity vulnerability due to its potential for SQL Injection exploitation.
How do I fix CVE-2024-48325?
To fix CVE-2024-48325, ensure proper sanitization and validation of the "instituicao_id" parameter in the affected function.
Which versions of Portabilis i-Educar are affected by CVE-2024-48325?
CVE-2024-48325 affects Portabilis i-Educar version 2.8.0.
What kind of attack can be executed due to CVE-2024-48325?
CVE-2024-48325 allows attackers to execute SQL Injection, potentially leading to unauthorized data access.
Is there a patch available for CVE-2024-48325?
As of now, a specific patch for CVE-2024-48325 has not been released, so users should implement immediate workarounds.