CVE-2025-9531: Portabilis i-Educar Agenda agenda.php sql injection
A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/agenda.php of the component Agenda Module. Performing a manipulation of the argument codagenda results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 2.12 mitigates this issue. It is suggested to upgrade the affected component. The vendor confirms: "The reported attack vector was tested against the corrected code, and the previously described SQL Injection behavior could no longer be reproduced."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Portabilis i-Educar Agenda agenda.php (Agenda Module)to a version that resolves this vulnerability.Fixed in 2.12
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9531?
CVE-2025-9531 is classified as a high severity vulnerability due to its potential for remote SQL injection attacks.
How do I fix CVE-2025-9531?
To fix CVE-2025-9531, update Portabilis i-Educar to version 2.11 or later, which addresses the SQL injection vulnerability.
What components are affected by CVE-2025-9531?
CVE-2025-9531 specifically affects the Agenda Module of Portabilis i-Educar up to version 2.10.
Can CVE-2025-9531 be exploited remotely?
Yes, CVE-2025-9531 can be exploited remotely by manipulating the cod_agenda argument in the agenda.php file.
What kind of attack is associated with CVE-2025-9531?
CVE-2025-9531 is associated with SQL injection attacks, which can compromise the database of the affected application.