PT-2026-82494 · Toools · Isquad
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
TOOOLS iSquad (affected versions not specified)
Description
An issue exists in the '/ws/apiprensa/getVideoSubcanal' endpoint caused by improper handling of the
id video parameter. The application fails to sanitize input before constructing SQL queries, allowing for SQL injection. This flaw also triggers the Slim framework error handler to expose internal file paths and complete stack traces, leading to information disclosure.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Avoid using the
id video parameter in the '/ws/apiprensa/getVideoSubcanal' endpoint until the issue is resolved.SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Isquad