CVE-2025-10012: Portabilis i-Educar educar_historico_escolar_lst.php sql injection
A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file educarhistoricoescolarlst.php. Such manipulation of the argument refcodaluno leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.12 is sufficient to resolve this issue. It is advisable to upgrade the affected component. The vendor confirms, that "[t]he reported attack vector was tested against the corrected code, and the previously described SQL Injection behavior could no longer be reproduced".
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Portabilis i-Educar educar_historico_escolar_lst.phpto a version that resolves this vulnerability.Fixed in 2.12
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10012?
CVE-2025-10012 has been classified as a high-severity vulnerability due to the possibility of remote SQL injection attacks.
How do I fix CVE-2025-10012?
To fix CVE-2025-10012, upgrade Portabilis i-Educar to a version later than 2.10 and ensure that input validation is properly implemented.
What systems are affected by CVE-2025-10012?
CVE-2025-10012 affects Portabilis i-Educar versions up to and including 2.10.
Can CVE-2025-10012 be exploited remotely?
Yes, CVE-2025-10012 can be exploited remotely, allowing attackers to perform SQL injection attacks.
What kind of attack does CVE-2025-10012 enable?
CVE-2025-10012 enables SQL injection attacks through manipulation of the ref_cod_aluno argument in the educar_historico_escolar_lst.php file.