CVE-2024-45059 Information

Description

i-Educar is free completely online school management software that allows school secretaries teachers coordinators and area managers. In affected versions Creating a SQL query from a concatenation of a user-controlled GET parameter allows an attacker to manipulate the query. Successful exploitation of this flaw allows an attacker to have complete and unrestricted access to the database with a web user with minimal permissions. This may involve obtaining user information such as emails password hashes etc. This issue has not yet been patched. Users are advised to contact the developer and to coordinate an update schedule.

Reference

https://github.com/portabilis/i-educar/security/advisories/GHSA-2v4w-7xqr-hxmr https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html https://portswigger.net/web-security/sql-injection