CVE-2025-9236: Portabilis i-Educar Tipos de usuàrio educar_tipo_usuario_lst.php sql injection
A vulnerability has been found in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educartipousuariolst.php of the component Tipos de usuàrio Page. Such manipulation of the argument nmtipo/descrição leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version 2.12 mitigates this issue. Upgrading the affected component is advised. The vendor confirms: "The reported attack vector was tested against the corrected code, and the previously described SQL Injection behavior could no longer be reproduced."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Portabilis i-Educar Tipos de usuàrio (intranet/educar_tipo_usuario_lst.php)to a version that resolves this vulnerability.Fixed in 2.12
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9236?
The severity of CVE-2025-9236 is critical due to the potential for SQL injection attacks.
How do I fix CVE-2025-9236?
To fix CVE-2025-9236, update Portabilis i-Diario to version 2.11 or later.
What type of attacks can CVE-2025-9236 facilitate?
CVE-2025-9236 can facilitate SQL injection attacks which can lead to unauthorized database access.
Which component is affected by CVE-2025-9236?
CVE-2025-9236 affects the Tipos de usàrio Page in the file /intranet/educar_tipo_usuario_lst.php.
Is CVE-2025-9236 present in earlier versions of the software?
Yes, CVE-2025-9236 is present in Portabilis i-Diario versions up to and including 2.10.