CVE-2024-45059 - CVE House
Back to Database
Status published High CVE-2024-45059

Authenticated SQL Injection in i-Educar

Vulnerability Description

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A SQL Injection vulnerability was found prior to the 2.9 branch in the `ieducar/intranet/funcionario_vinculo_det.php` file, which creates the query by concatenating the unsanitized GET parameter `cod_func`, allowing the attacker to obtain sensitive information such as emails and password hashes. Commit 7824b95745fa2da6476b9901041d9c854bf52ffe fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-45059

Credits & Attribution

No credits recorded in the NVD database.

References

More from portabilis

View All →
CVE-2025-65024
i-Educar Authenticated Time-based SQL Injection in `agenda_admin_cad.php`
High 7.2
CVE-2025-65023
i-Educar Authenticated Time-based SQL Injection in `funcionario_vinculo_cad.php`
High 7.2
CVE-2025-65022
i-Educar Authenticated Time-based SQL Injection in `agenda.php`
High 7.2
CVE-2024-55651
i-Educar Stored Cross-Site Scripting vulnerability
Low 2
CVE-2024-45058
Privilege escalation in i-Educar
High 8.1

Affected Vendor

Affected Software

i-educar
Vulnerable Versions:
< 2.9

Timeline

Official Publish: August 28th, 2024
Last Modified: September 6th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact