CVE-2025-65022 — CVE & Security Advisory Radar

🎯 CVE-2025-65022 🧪 PoC 🇪🇺 EUVD

📄 .md Alle CVEs anzeigen ✕

CVE-2025-65022 | i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. This vulnerability is caused by the improper handling of the cod_agenda request parameter, which is directly concatenated into multiple SQL queri

i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. This vulnerability is caused by the improper handling of the cod_agenda request parameter, which is directly concatenated into multiple SQL queries without proper sanitization. This issue has been patched in commit b473f92.

Klassifikation & Betroffenheit:

Portábilis i-Educar ≤ 2.10.0portabilis i-educar *

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 🎯 High

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as…

🛡️ Empfohlene Mitigation: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, consider using persistence layers such as Hibernate or Enterprise Java Beans, which can provide significant protection against SQL injection if used proper…

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-7 · Blind SQL Injection (High) CAPEC-66 · SQL Injection (High) CAPEC-108 · Command Line Execution through SQL Injec… (Very High) CAPEC-109 · Object Relational Mapping Injection (High) CAPEC-110 · SQL Injection through SOAP Parameter Tam… (Very High) CAPEC-470 · Expanding Control over the Operating Sys… (Very High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2024-45058 8.1 CVE-2025-65023 7.2 CVE-2025-65024 7.2 CVE-2025-9109 6.3 CVE-2024-45057 6.3

🩹 Patch verfügbar (OSV):

🩹 b473f92b5326f45d7bce2de93a5381bed7ca8ac7 (Commit)

📰 Eigene Berichterstattung: ➔ CVE-2025-65022 | Portabilis i-Educar up to 2.10.0 agenda.php cod_agenda sql inje

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2025

Veröffentlicht 11/2025

Heute 17.09.

CVSS-Vektor-Analyse: 7.2

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Hoch

UI · Interaktion Keine

S · Scope Unverändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Veröffentlicht:19.11.2025

Aktualisiert:17.06.2026 09:55

Assigner (CNA):GitHub_M

EUVD-ID:EUVD-2025-198238

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-89: SQL Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	2026-08-29	2026-09-16
≥90 %	4	0
≥50 %	4	0
≥10 %	3	0
<10 %	304	300

7.2 HIGH

🇪🇺 EUVD

EPSS

31%

CVE-2025-65022 🌐 Netzwerk (Remote) 🔐 Admin-Rechte nötig

🧪 Portábilis

CVE-2025-65022 | i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. This vulnerability is caused by the improper handling of the cod_agenda request parameter, which is directly concatenated into multiple SQL queri

CWE-89: SQL Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

19.11.2025

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub