A critical SQL injection vulnerability in Portabilis i-Educar allows authenticated attackers to perform unauthorized database operations, posing a significant risk to data integrity and system security.

This is a time-based SQL injection flaw (CWE-89) located in the ieducar/intranet/funcionario_vinculo_cad.php script. The application fails to properly sanitize the cod_funcionario_vinculo GET parameter, which allows any authenticated user to execute arbitrary SQL commands against the database.

The ability to execute arbitrary SQL commands grants an attacker the power to read, modify, or delete sensitive school management data, including student records and administrative credentials. Given the CVSS score of 7.2, this vulnerability represents a high risk, as it could lead to full database compromise, unauthorized access to administrative functions, and potential loss of data confidentiality and integrity.

Immediate Action: Update to the latest version of i-Educar or apply the fix provided in commit a00dfa3f129bc84e27873aa01cbd3f82e5b6c6c8.

Proactive Monitoring: Review web server and database logs for anomalous behavior, specifically looking for unusual GET requests containing SQL syntax or extended execution times.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in URL parameters to mitigate risk until the software can be updated.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates immediate attention from IT administrators managing i-Educar deployments. Because the flaw allows for direct database manipulation by authenticated users, applying the vendor-provided patch is the only definitive way to secure the environment. Organizations should prioritize updating their instances and auditing user accounts to ensure no unauthorized access has occurred.