CVE-2025-9606: Portabilis i-Educar agenda_preferencias.php sql injection
A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/agendapreferencias.php. Performing a manipulation of the argument codagenda results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. Upgrading to version 2.12 addresses this issue. Upgrading the affected component is advised. The vendor confirms: "The reported attack vector was tested against the corrected code, and the previously described SQL Injection behavior could no longer be reproduced."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Portabilis i-Educarto a version that resolves this vulnerability.Fixed in 2.12
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9606?
CVE-2025-9606 has a critical severity due to the potential for SQL injection vulnerabilities that can be exploited remotely.
How do I fix CVE-2025-9606?
To fix CVE-2025-9606, update Portabilis i-Educar to a version higher than 2.10 and implement input validation on the affected parameters.
What software is affected by CVE-2025-9606?
CVE-2025-9606 affects Portabilis i-Educar versions up to and including 2.10.
What is the impact of CVE-2025-9606?
The impact of CVE-2025-9606 includes unauthorized access to the database through SQL injection, potentially leading to data loss.
Can CVE-2025-9606 be exploited remotely?
Yes, CVE-2025-9606 can be exploited remotely, allowing attackers to manipulate the affected functionality.