CVE-2025-9684: Portabilis I-educar SQL Injection Vulnerability

CVE-2025-9684 Overview

CVE-2025-9684 is a SQL injection vulnerability in Portabilis i-Educar versions up to 2.10. The flaw resides in the /module/FormulaMedia/edit endpoint, part of the Formula de Cálculo de Média component. Attackers can manipulate the id parameter to inject arbitrary SQL statements into backend database queries. Exploitation occurs remotely over the network and requires low-privilege authenticated access. Public disclosure of the exploit technique has occurred through external research repositories, increasing the likelihood of opportunistic abuse against unpatched school management deployments [CWE-74].

Critical Impact
Authenticated remote attackers can execute blind time-based SQL injection through the id parameter, exposing student records, grade calculations, and administrative data stored within i-Educar databases.

Affected Products

Portabilis i-Educar versions up to and including 2.10
Component: Formula de Cálculo de Média (/module/FormulaMedia/edit)
Vulnerable parameter: id

Discovery Timeline

2025-08-30 - CVE-2025-9684 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9684

Vulnerability Analysis

The vulnerability is a blind time-based SQL injection in the FormulaMedia.edit endpoint of Portabilis i-Educar, a Brazilian open-source school management platform. The id parameter passed to this endpoint is concatenated into a SQL statement without proper parameterization or input validation. An authenticated attacker can craft payloads that introduce conditional time-delay functions, allowing inference of database contents byte by byte through measurable response delays. Because the injection occurs in a record-edit workflow tied to grade formulas, successful exploitation can lead to read access against sensitive academic records and, depending on database privileges, modification of stored data. Public technical write-ups describing the payload structure are available in the referenced GitHub repository, lowering the barrier to exploitation.

Root Cause

The root cause is improper neutralization of special elements in a SQL command [CWE-74]. The id argument supplied to the /module/FormulaMedia/edit route is interpolated directly into a database query rather than bound through parameterized statements or prepared queries. No type coercion or allow-list validation rejects non-numeric values before query construction.

Attack Vector

Exploitation requires network access to the i-Educar web interface and a valid low-privilege account. The attacker issues HTTP requests to the FormulaMedia/edit endpoint with a crafted id parameter containing SQL payloads. Time-based blind techniques such as SLEEP() or conditional pg_sleep() calls confirm injection and enumerate database contents. Refer to the GitHub technical write-up for payload details and the VulDB entry #321896 for additional context.

Detection Methods for CVE-2025-9684

Indicators of Compromise

HTTP requests to /module/FormulaMedia/edit containing SQL keywords such as SLEEP, pg_sleep, BENCHMARK, UNION, or SELECT within the id parameter
Anomalously long response times for FormulaMedia/edit requests, indicating time-based blind injection probing
Repeated requests from a single authenticated session iterating values of id with encoded SQL syntax
Database error log entries referencing the FormulaMedia query path or syntax errors tied to the id column

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the id parameter on the FormulaMedia/edit route for SQL metacharacters and time-delay functions
Enable database query logging and alert on queries originating from the FormulaMedia module that include conditional time functions
Correlate authenticated user sessions with high-volume requests to a single endpoint to identify enumeration patterns

Monitoring Recommendations

Monitor i-Educar web server access logs for non-integer values in the id query parameter on /module/FormulaMedia/edit
Track database CPU and response latency baselines so time-based injection probes surface as anomalies
Audit low-privilege accounts performing unusual access to grade formula management functions

How to Mitigate CVE-2025-9684

Immediate Actions Required

Restrict access to the /module/FormulaMedia/edit endpoint to trusted administrative IP ranges until a vendor patch is applied
Review and reduce database account privileges used by the i-Educar application to the minimum required for normal operation
Audit recent access logs for the FormulaMedia endpoint to identify potential prior exploitation attempts
Rotate credentials for any administrative or service accounts that may have been exposed through the database

Patch Information

No vendor advisory or fixed version is listed in the NVD entry at the time of publication. Monitor the Portabilis i-Educar project for updates beyond version 2.10 that address the FormulaMedia SQL injection. Until an official patch is released, apply the workarounds below and treat the endpoint as untrusted.

Workarounds

Block or rate-limit requests to /module/FormulaMedia/edit at a reverse proxy or WAF when the id parameter contains non-numeric characters
Apply server-side input validation that coerces the id parameter to an integer before it reaches the database layer
Refactor affected queries to use parameterized statements or prepared queries instead of string concatenation
Disable the Formula de Cálculo de Média module for non-administrative roles where business processes allow

bash

# Example reverse-proxy rule (nginx) rejecting non-numeric id values
location /module/FormulaMedia/edit {
    if ($arg_id !~ "^[0-9]+$") {
        return 400;
    }
    proxy_pass http://i_educar_backend;
}