CVE-2026-81672: Multiple Vulnerabilities in TOOOLS' iSquad
SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the idvideo parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes internal file paths and complete stack traces through the Slim framework’s error handler, which increases the severity due to the combination of information disclosure and SQL injection.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to reach the vulnerable functionality?
The vulnerable endpoint is /ws/apiprensa/getVideoSubcanal. The available information does not state that authentication or any specific privilege is required.
What information may be exposed when exploitation attempts trigger errors?
Malicious id_video input can cause SQL execution errors that are handled by the Slim framework error handler. The reported disclosures include internal file paths and complete stack traces.
How can defenders identify potential exploitation attempts?
Review requests to /ws/apiprensa/getVideoSubcanal for unexpected or malicious-looking values supplied through the id_video parameter. Also investigate application logs for SQL execution errors, Slim error-handler responses, stack traces, or file-path disclosures associated with this endpoint.