CVE-2026-81674: Multiple Vulnerabilities in TOOOLS' iSquad
The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the idambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database error messages and exposes the internal structure of the queries, which could facilitate further exploitation.
Affected Software
Event History
Frequently Asked Questions
What access would an attacker need to exploit this issue?
An attacker would need to be able to send a request to the /ws/apiprensa/getVideoNextPrev endpoint with a crafted id_ambito parameter. The provided information does not state that authentication is required.
What information can be exposed by successful exploitation?
The issue can produce detailed MariaDB error messages that reveal database and query internals. This information may help an attacker understand the application's database structure and develop further attacks.
How can defenders identify potentially affected requests?
Review requests to /ws/apiprensa/getVideoNextPrev, particularly id_ambito values containing SQL syntax or unexpected special characters. Also investigate application or database logs for MariaDB query errors associated with this endpoint.