A critical SQL injection vulnerability in the TOOOLS iSquad platform allows unauthenticated attackers to execute arbitrary database queries and expose sensitive information.

This vulnerability is a classic SQL injection (CWE-89) located in the /ws/apiprensa/getVideo endpoint. The application fails to sanitize the id_ambito GET parameter, permitting an unauthenticated attacker to manipulate MariaDB queries and trigger verbose database error messages.

The ability for an unauthenticated attacker to manipulate backend database queries poses a significant risk to data confidentiality. By extracting database structure or contents, unauthorized parties could gain access to sensitive organizational information, leading to potential data breaches and regulatory non-compliance. Given the CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent exploitation.

Immediate Action: Update the TOOOLS iSquad application to the version released on or after 22/07/2026 to incorporate the necessary input validation and prepared statement fixes.

Proactive Monitoring: Monitor database query logs for unusual syntax patterns, unexpected PDOException entries, or attempts to access database schema information via the /ws/apiprensa/getVideo endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with updated SQL injection detection signatures to block malicious payloads targeting the id_ambito parameter until the software update is fully deployed.

Public Exploit Available: Unknown

The vulnerability represents a significant security oversight that could lead to unauthorized data exposure. Security teams must prioritize applying the vendor-provided update immediately, as the lack of authentication makes this an attractive target for automated scanning and exploitation. If an immediate update is not feasible, ensure that network-level controls and WAF rules are configured to restrict access to the affected endpoint.