CVE-2025-65023: i-Educar Authenticated Time-based SQL Injection in `funcionario_vinculo_cad.php`
i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/funcionariovinculocad.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. This vulnerability is caused by the improper handling of the codfuncionariovinculo GET parameter, which is directly concatenated into an SQL query without proper sanitization. This issue has been patched in commit a00dfa3.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65023?
CVE-2025-65023 is classified as a medium severity vulnerability.
How do I fix CVE-2025-65023?
To fix CVE-2025-65023, upgrade to versions later than 2.10.0 of i-Educar.
What type of vulnerability is CVE-2025-65023?
CVE-2025-65023 is an authenticated time-based SQL injection vulnerability.
Who is affected by CVE-2025-65023?
Users running i-Educar versions 2.10.0 and earlier are affected by CVE-2025-65023.
Can CVE-2025-65023 be exploited remotely?
CVE-2025-65023 requires an authenticated session, thus it is not remotely exploitable without credentials.