Isquad
Monthly
SQL injection in Toools Isquad's '/ws/apiprensa/getVideo' endpoint exposes the MariaDB backend to unauthenticated remote attackers who can manipulate the 'id_ambito' GET parameter. Direct string concatenation of user input into SQL statements - without parameterized queries - causes query structure breakage and leaks raw PDOException error messages, actively confirming exploitability and revealing database schema details. No public exploit is identified at time of analysis, but INCIBE has documented this as one of multiple vulnerabilities in this product and a vendor patch is available.
Error-based SQL injection in Toools iSquad's `/ws/apitribuna/ultimosVideos` API endpoint enables unauthenticated remote attackers to manipulate MariaDB queries and extract sensitive database contents. The `limit_videos` parameter is concatenated unsanitized into the SQL query, a textbook CWE-89 flaw. The application returns database error messages and stack traces on injection, exposing schema details and backend implementation specifics. No active exploitation is confirmed (not in CISA KEV) and no public POC has been identified, but the unauthenticated network vector with high confidentiality impact warrants prompt remediation.
SQL injection in toools Isquad lets remote unauthenticated attackers manipulate database queries via the id_seccion parameter of the '/ws/apiprensa/getVideoUltimasSeccion' web-service endpoint. The parameter is concatenated into a complex query using grouping and sorting, letting an attacker break the query structure, trigger database errors that leak internal query logic, and potentially extract or alter content-retrieval data. No public exploit is identified at time of analysis, though the flaw is trivially reachable (AV:N/AC:L/PR:N) and carries a 9.3 CVSS 4.0 score.
SQL injection in toools Isquad exposes the '/ws/apiprensa/getVideoNextPrev' endpoint to unauthenticated database manipulation through the unsanitized id_ambito parameter, which is concatenated directly into a MariaDB query. Remote attackers can inject arbitrary SQL syntax to break query execution, trigger verbose database error messages, and enumerate the internal query and schema structure, which facilitates full data extraction. Reported by INCIBE with a vendor patch available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in Toools iSquad exposes the unauthenticated '/ws/apitribuna/setVisita' web-service endpoint, where the id_video and id_ambito parameters flow into SQL queries without validation or sanitization (CWE-89). Remote attackers can inject arbitrary SQL to disrupt query execution, trigger database errors, and manipulate visit-tracking records, corrupting the integrity of analytics data. The flaw was reported by Spain's INCIBE-CERT and a vendor patch is available; no public exploit identified at time of analysis.
SQL injection in Toools iSquad's '/ws/apiprensa/getVideoSubcanal' API endpoint lets remote unauthenticated attackers manipulate backend database queries via the unsanitized 'id_video' parameter. Failed injection attempts trigger the Slim framework's default error handler, which discloses internal file paths and full stack traces, compounding the SQLi with an information-disclosure primitive. No public exploit has been identified at time of analysis, but a vendor patch is available via INCIBE advisory INCIBE-CERT.
SQL injection in Toools Isquad's '/ws/apiprensa/getVideo' endpoint exposes the MariaDB backend to unauthenticated remote attackers who can manipulate the 'id_ambito' GET parameter. Direct string concatenation of user input into SQL statements - without parameterized queries - causes query structure breakage and leaks raw PDOException error messages, actively confirming exploitability and revealing database schema details. No public exploit is identified at time of analysis, but INCIBE has documented this as one of multiple vulnerabilities in this product and a vendor patch is available.
Error-based SQL injection in Toools iSquad's `/ws/apitribuna/ultimosVideos` API endpoint enables unauthenticated remote attackers to manipulate MariaDB queries and extract sensitive database contents. The `limit_videos` parameter is concatenated unsanitized into the SQL query, a textbook CWE-89 flaw. The application returns database error messages and stack traces on injection, exposing schema details and backend implementation specifics. No active exploitation is confirmed (not in CISA KEV) and no public POC has been identified, but the unauthenticated network vector with high confidentiality impact warrants prompt remediation.
SQL injection in toools Isquad lets remote unauthenticated attackers manipulate database queries via the id_seccion parameter of the '/ws/apiprensa/getVideoUltimasSeccion' web-service endpoint. The parameter is concatenated into a complex query using grouping and sorting, letting an attacker break the query structure, trigger database errors that leak internal query logic, and potentially extract or alter content-retrieval data. No public exploit is identified at time of analysis, though the flaw is trivially reachable (AV:N/AC:L/PR:N) and carries a 9.3 CVSS 4.0 score.
SQL injection in toools Isquad exposes the '/ws/apiprensa/getVideoNextPrev' endpoint to unauthenticated database manipulation through the unsanitized id_ambito parameter, which is concatenated directly into a MariaDB query. Remote attackers can inject arbitrary SQL syntax to break query execution, trigger verbose database error messages, and enumerate the internal query and schema structure, which facilitates full data extraction. Reported by INCIBE with a vendor patch available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in Toools iSquad exposes the unauthenticated '/ws/apitribuna/setVisita' web-service endpoint, where the id_video and id_ambito parameters flow into SQL queries without validation or sanitization (CWE-89). Remote attackers can inject arbitrary SQL to disrupt query execution, trigger database errors, and manipulate visit-tracking records, corrupting the integrity of analytics data. The flaw was reported by Spain's INCIBE-CERT and a vendor patch is available; no public exploit identified at time of analysis.
SQL injection in Toools iSquad's '/ws/apiprensa/getVideoSubcanal' API endpoint lets remote unauthenticated attackers manipulate backend database queries via the unsanitized 'id_video' parameter. Failed injection attempts trigger the Slim framework's default error handler, which discloses internal file paths and full stack traces, compounding the SQLi with an information-disclosure primitive. No public exploit has been identified at time of analysis, but a vendor patch is available via INCIBE advisory INCIBE-CERT.