Dylancv

**Name of the Vulnerable Software and Affected Versions** TOOOLS iSquad (affected versions not specified) **Description** An issue exists in the '/ws/apiprensa/getVideoSubcanal' endpoint caused by improper handling of the `id video` parameter. The application fails to sanitize input before constructing SQL queries, allowing for SQL injection. This flaw also triggers the Slim framework error handler to expose internal file paths and complete stack traces, leading to information disclosure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `id video` parameter in the '/ws/apiprensa/getVideoSubcanal' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** TOOOLS iSquad (affected versions not specified) **Description** The '/ws/apitribuna/setVisita' endpoint is susceptible to SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. This occurs because the application fails to validate or sanitize the `id video` and `id ambito` parameters before incorporating them into SQL queries. A remote attacker can exploit this to disrupt query execution, trigger database errors, and manipulate visit tracking records, which may compromise the integrity of analytics and record accuracy. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `id video` and `id ambito` parameters in the '/ws/apitribuna/setVisita' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** TOOOLS (affected versions not specified) **Description** The endpoint '/ws/apiprensa/getVideoNextPrev' is susceptible to SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. This occurs because unsanitized input provided via the `id ambito` parameter is directly incorporated into a MariaDB query. This flaw allows attackers to interrupt query execution, triggering detailed database error messages that expose the internal structure of the queries. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the parameter `id ambito` in the '/ws/apiprensa/getVideoNextPrev' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** TOOOLS iSquad (affected versions not specified) **Description** The endpoint '/ws/apiprensa/getVideoUltimasSeccion' is susceptible to SQL injection via the `id seccion` parameter. This parameter is directly embedded into a complex SQL query involving grouping and sorting operations. An attacker can inject SQL syntax to disrupt the query structure, trigger database errors, and expose internal query logic, potentially allowing for broader manipulation of how content is retrieved. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the parameter `id seccion` in the '/ws/apiprensa/getVideoUltimasSeccion' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** TOOOLS iSquad (affected versions not specified) **Description** An error-based SQL injection exists in the '/ws/apitribuna/ultimosVideos' endpoint. The `limit videos` parameter is concatenated directly into a MariaDB SQL query without proper sanitization or parameterization. A remote attacker can inject SQL syntax into this parameter to cause syntax errors, manipulate backend queries, and expose internal database error messages and stack traces, which reveals backend implementation details. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `limit videos` parameter in the '/ws/apitribuna/ultimosVideos' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** TOOOLS iSquad (affected versions not specified) **Description** The '/ws/apiprensa/getVideo' endpoint is susceptible to SQL injection because the GET parameter `id ambito` is not properly validated. This allows an attacker to inject SQL syntax that disrupts the MariaDB query structure, leading to syntax errors and the disclosure of database error messages through PDOException. This occurs because user input is integrated directly into SQL statements without sanitization or the use of prepared statements. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the parameter `id ambito` in the '/ws/apiprensa/getVideo' endpoint until the issue is resolved.