A critical SQL injection vulnerability in Portabilis i-Educar allows authenticated attackers to execute arbitrary database commands, posing a significant risk to data confidentiality and integrity.

This is a time-based SQL injection vulnerability (CWE-89) triggered by improper sanitization of the cod_agenda GET parameter in the ieducar/intranet/agenda_admin_cad.php script. The vulnerability requires an authenticated session to exploit, allowing an attacker to manipulate backend database queries.

Successful exploitation allows an unauthorized user to perform arbitrary SQL operations against the application database, which can lead to full database compromise, unauthorized data exfiltration, or modification of administrative records. Given the CVSS score of 7.2, this flaw presents a high risk to organizational data integrity and regulatory compliance, particularly in an educational environment where student data is processed.

Immediate Action: Update the i-Educar installation to a version containing the fix associated with commit 3e9763a, or apply the patch directly from the vendor repository.

Proactive Monitoring: Review application access logs for unusual GET requests targeting the agenda_admin_cad.php script, specifically monitoring for anomalous characters or time-delay patterns in the cod_agenda parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests containing SQL syntax or suspicious patterns within the cod_agenda query parameter.

Public Exploit Available: No

The severity of this SQL injection vulnerability necessitates prompt remediation to prevent potential database compromise. Administrators should verify their current version of i-Educar and apply the necessary security updates or patches immediately. If an immediate update is not feasible, ensure that administrative access is strictly restricted to authorized personnel to mitigate the risk of authenticated exploitation.