CVE-2025-9531

Summary

A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/agenda.php of the component Agenda Module. Performing manipulation of the argument cod_agenda results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

VendorProductVersion RangeStatus
Portabilisi-Educar2.0affected
Portabilisi-Educar2.1affected
Portabilisi-Educar2.2affected
Portabilisi-Educar2.3affected
Portabilisi-Educar2.4affected
Portabilisi-Educar2.5affected
Portabilisi-Educar2.6affected
Portabilisi-Educar2.7affected
Portabilisi-Educar2.8affected
Portabilisi-Educar2.9affected
Portabilisi-Educar2.10affected

Weaknesses

  • CWE-89: SQL Injection
  • CWE-74: Injection

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References