CVE-2024-48325
Published: 06 November 2024
Summary
CVE-2024-48325 is a high-severity SQL Injection (CWE-89) vulnerability in Portabilis I-Educar. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Portabilis i-Educar version 2.8.0 contains a SQL injection vulnerability in the getDocuments function of the InstituicaoDocumentacaoController class. The instituicao_id parameter passed to the endpoint /module/Api/InstituicaoDocumentacao is not sanitized before being used in SQL queries, enabling an attacker to supply arbitrary SQL commands via the oper=get and resource=getDocuments parameters.
An unauthenticated remote attacker can exploit the flaw to read or modify database contents, achieving high confidentiality and integrity impact without requiring user interaction. The CVSS 3.1 score of 8.1 reflects network attack vector, low complexity, and low privileges needed.
The single public reference is a GitHub repository that documents the issue but provides no vendor advisory or patch information. The associated EPSS score has remained steady at 0.1263 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-42993
Vulnerability details
Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. The "instituicao_id" parameter in "/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id" is not properly sanitized, allowing an unauthenticated remote attacker to inject malicious SQL commands.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unauthenticated SQL injection vulnerability in the public-facing web application's API endpoint enables exploitation for initial access (T1190) and collection of data from databases via arbitrary SQL queries, including enumeration with tools like SQLMap (T1213.006).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.