CVE-2026-81675: Multiple Vulnerabilities in TOOOLS' iSquad
The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the idseccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and cause database errors, exposing the internal logic of the queries. The complexity of the query increases the potential impact, as it could allow for broader manipulation of the content retrieval logic.
Event History
Frequently Asked Questions
What access does an attacker need to reach the vulnerable functionality?
An attacker needs to be able to send a request to the /ws/apiprensa/getVideoUltimasSeccion endpoint and control the id_seccion parameter. The provided information does not state that authentication is required.
What can exploitation reveal or affect?
Injected SQL syntax can alter the structure of the endpoint's complex query, disrupt content retrieval logic, and trigger database errors that expose internal query logic. The query's grouping and sorting operations may increase the scope for manipulation of returned content.
How can defenders identify possible exploitation attempts?
Review requests to /ws/apiprensa/getVideoUltimasSeccion for unexpected SQL syntax or malformed values in id_seccion, and correlate them with database errors from the associated query. The provided information does not include specific payloads or log indicators.