CVE-2025-41009 — SQL injection on the virtual campus platform of Diseño de Recursos Educativos

CVE-2025-41009

SQL injection on the virtual campus platform of Diseño de Recursos Educativos PUBLISHED

Description (CNA)

SQL injection vulnerability in the DRED virtual campus platform. This vulnerability allows an attacker to retrieve, create, update, and delete data from the database by sending a POST request using the ‘buscame’ parameter in ‘/catalogo_c/catalogo.php’.

Affected (CNA)

Vendor / product	Versions
Disenno de Recursos Educativos S.L / virtual campus platform	affected all versions

CWE

CWE-89

References

https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-virtual-campus-platform-diseno-de-recursos-educativos

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.