A critical SQL injection vulnerability in Portabilis i-Educar allows authenticated attackers to perform unauthorized database operations, potentially leading to total system compromise.

This is a time-based SQL injection (CWE-89) located in the ieducar/intranet/agenda.php script. The vulnerability arises because the cod_agenda parameter is concatenated directly into SQL queries without proper input sanitization, requiring an attacker to have an active authenticated session to trigger the flaw.

The ability to execute arbitrary SQL commands poses a severe risk to the confidentiality, integrity, and availability of institutional data. With a CVSS score of 7.2, this high-severity flaw could allow an attacker to exfiltrate sensitive student or administrative records, modify database contents, or disrupt critical school management operations.

Immediate Action: Upgrade to the latest version of i-Educar or apply the fix provided in commit b473f92b5326f45d7bce2de93a5381bed7ca8ac7.

Proactive Monitoring: Review database access logs for unusual query patterns, particularly those involving long execution times or syntax errors associated with the agenda.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and sanitize incoming SQL parameters, specifically targeting the cod_agenda field.

Public Exploit Available: No (no confirmed public weaponized exploit exists).

Given the potential for total impact on the database, administrators should prioritize applying the vendor provided patch immediately. If an immediate update is not feasible, restrict access to the affected script to only those users who strictly require it, while implementing enhanced monitoring to detect any attempts to leverage this injection vector.