EUVD-2026-67005
GHSA-67gh-45qv-f464
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated SQLi over the network with low complexity (PR:N/AC:L/AV:N); direct DB read/write and error-based disclosure justify C:H/I:H, and potential data/DoS impact supports A:H with unchanged scope.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the id_video parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes internal file paths and complete stack traces through the Slim framework’s error handler, which increases the severity due to the combination of information disclosure and SQL injection.
AnalysisAI
SQL injection in Toools iSquad's '/ws/apiprensa/getVideoSubcanal' API endpoint lets remote unauthenticated attackers manipulate backend database queries via the unsanitized 'id_video' parameter. Failed injection attempts trigger the Slim framework's default error handler, which discloses internal file paths and full stack traces, compounding the SQLi with an information-disclosure primitive. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The specific prerequisite is that the target exposes the '/ws/apiprensa/getVideoSubcanal' API endpoint and processes the 'id_video' request parameter, which is passed unsanitized into a SQL query. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals align toward genuine high priority: the vendor CVSS 4.0 base score is 9.3 (Critical) with vector AV:N/AC:L/AT:N/PR:N/UI:N and high confidentiality, integrity, and availability impact to the vulnerable system (VC:H/VI:H/VA:H), indicating remote, low-complexity, unauthenticated exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote, unauthenticated attacker sends a crafted HTTP request to '/ws/apiprensa/getVideoSubcanal' with a malicious 'id_video' value (e.g., a boolean/error-based or UNION payload). The application executes the tainted query; malformed input returns Slim stack traces that reveal file paths and schema hints, which the attacker uses to refine payloads and extract or modify database contents. … |
| Remediation | Apply the vendor-supplied patch referenced in the INCIBE-CERT advisory (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-toools-isquad); Patch available per vendor advisory, though an exact fixed version string was not included in the provided data, so confirm the target release directly with Toools/INCIBE before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Toools iSquad deployments and confirm whether the product is exposed to the internet or untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in toools Isquad lets remote unauthenticated attackers manipulate database queries via the id_seccion para
SQL injection in toools Isquad exposes the '/ws/apiprensa/getVideoNextPrev' endpoint to unauthenticated database manipul
SQL injection in Toools iSquad exposes the unauthenticated '/ws/apitribuna/setVisita' web-service endpoint, where the id
SQL injection in Toools Isquad's '/ws/apiprensa/getVideo' endpoint exposes the MariaDB backend to unauthenticated remote
Error-based SQL injection in Toools iSquad's `/ws/apitribuna/ultimosVideos` API endpoint enables unauthenticated remote
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today