An unauthenticated SQL injection vulnerability in TOOOLS iSquad allows remote attackers to compromise database integrity and expose sensitive system information.

The application fails to sanitize the limit_videos parameter before concatenating it into a MariaDB query, resulting in an error-based SQL injection. This flaw is accessible to unauthenticated remote attackers.

Successful exploitation allows an attacker to manipulate backend database queries, potentially leading to unauthorized data access or service disruption. With a CVSS score of 8.8, this high-severity vulnerability poses a significant risk to data confidentiality, as the injection of malicious syntax can expose internal error messages, stack traces, and sensitive implementation details.

Immediate Action: Update the iSquad instance to the version released on or after 22/07/2026 as specified by the vendor.

Proactive Monitoring: Review application logs for anomalous SQL syntax errors or unexpected database query patterns originating from the /ws/apitribuna/ultimosVideos endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to filter malicious input directed at the vulnerable parameter until the update is applied.

Public Exploit Available: exploit_available (false)

Given the high CVSS score and the potential for unauthenticated remote exploitation, organizations should prioritize patching this vulnerability immediately. Ensure that the TOOOLS iSquad software is updated to the remediated version to close the identified SQL injection vector and prevent unauthorized access to the underlying MariaDB database.