CVE-2024-48325 SQL injection in n/a

What is CVE-2024-48325?

CVE-2024-48325 is a high-severity SQL injection vulnerability in Portabilis I-Educar, published on 6 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. The "instituicao_id" parameter in "/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id" is not properly sanitized, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Weakness: CWE-89

Which versions are affected by CVE-2024-48325?

It affects 1 product.

Products include Portabilis I-Educar.

How do I fix CVE-2024-48325?

No fix has been published for CVE-2024-48325 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2024-48325 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-48325 exists.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Portabilis I-Educar

• CVE-2024-45059 Authenticated SQL Injection in i-Educar High 8.8
• CVE-2024-45058 Privilege escalation in i-Educar High 8.1
• CVE-2025-65022 i-Educar Authenticated Time-based SQL Injection in `agenda.php` High 7.2
• CVE-2025-65023 i-Educar Authenticated Time-based SQL Injection in `funcionario_vinculo_cad.php` High 7.2
• CVE-2025-65024 i-Educar Authenticated Time-based SQL Injection in `agenda_admin_cad.php` High 7.2

All Portabilis I-Educar vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3fgp-h8mw-wrh5.