CVE-2025-65024: i-Educar Authenticated Time-based SQL Injection in `agenda_admin_cad.php`
i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agendaadmincad.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. This vulnerability is caused by the improper handling of the codagenda GET parameter, which is directly concatenated into an SQL query without proper sanitization. This issue has been patched in commit 3e9763a.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65024?
CVE-2025-65024 is considered a high severity vulnerability due to its potential for authenticated SQL injection.
How do I fix CVE-2025-65024?
To fix CVE-2025-65024, update i-Educar to version 2.10.1 or later.
What kind of vulnerability is CVE-2025-65024?
CVE-2025-65024 is an authenticated time-based SQL injection vulnerability.
What versions of i-Educar are affected by CVE-2025-65024?
Versions 2.10.0 and prior of i-Educar are affected by CVE-2025-65024.
Can an attacker exploit CVE-2025-65024 remotely?
No, an attacker must have access to an authenticated session to exploit CVE-2025-65024.