Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. The "instituicao_id" parameter in "/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id" is not properly sanitized, allowing an unauthenticated remote attacker to inject malicious SQL commands.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/osvaldotenorio/cve-2024-48325 |
Configurations
No configuration.
History
06 Nov 2024, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-06 23:15
Updated : 2024-11-06 23:15
NVD link : CVE-2024-48325
Mitre link : CVE-2024-48325
CVE.ORG link : CVE-2024-48325
JSON object : View
Products Affected
No product.
CWE
No CWE.