CVE-2025-65022: i-Educar Authenticated Time-based SQL Injection in `agenda.php`
i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. This vulnerability is caused by the improper handling of the codagenda request parameter, which is directly concatenated into multiple SQL queries without proper sanitization. This issue has been patched in commit b473f92.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65022?
CVE-2025-65022 is rated as a critical vulnerability due to its potential to allow authenticated attackers to execute arbitrary SQL commands.
How do I fix CVE-2025-65022?
To mitigate CVE-2025-65022, users should upgrade to i-Educar version 2.10.1 or later, which addresses the SQL injection vulnerability.
What products are affected by CVE-2025-65022?
CVE-2025-65022 affects all versions of i-Educar up to and including 2.10.0.
Who can exploit CVE-2025-65022?
An attacker with access to an authenticated session can exploit CVE-2025-65022 to perform SQL injection attacks.
What type of vulnerability is CVE-2025-65022?
CVE-2025-65022 is classified as a time-based SQL injection vulnerability.