CVE-2026-81677: Multiple Vulnerabilities in TOOOLS' iSquad
The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter idambito. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via PDOException. This confirms that user input is being incorporated directly into SQL statements without proper sanitization or the use of prepared statements.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to reach the vulnerable functionality?
The vulnerable endpoint is exposed at /ws/apiprensa/getVideo and accepts the id_ambito GET parameter. The provided information does not state that authentication or other privileges are required.
What evidence indicates that SQL injection is possible?
SQL syntax supplied through id_ambito can break the MariaDB query structure and trigger PDOException database error messages. This indicates that input is incorporated into SQL statements without adequate sanitization or prepared statements.
How can exposure be reduced if a fix is not immediately available?
Restrict access to the /ws/apiprensa/getVideo endpoint where possible and validate id_ambito server-side before it reaches database queries. Use parameterized queries or prepared statements rather than incorporating the parameter directly into SQL.