External risk intelligence

SQL Injection in DRED Virtual Campus Platform Via Buscame Parameter.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-41009

The vulnerability affects a virtual campus platform via a public-facing web endpoint (/catalogo_c/catalogo.php). Platforms of this nature are typically deployed as web applications intended for access by students and faculty over the internet, making the vulnerable parameter part of an externally reachable web interface.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A SQL injection vulnerability has been identified in the DRED virtual campus platform, allowing unauthorized access to sensitive data. This issue enables attackers to perform actions like retrieving, creating, updating, or deleting information within the platform's database.

Attackers can manipulate data through the platform's web interface.
This could compromise academic or user information stored in the database.
Confirm relevance to understand potential exposure to sensitive data.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted POST request to the `/catalogo_c/catalogo.php` endpoint. This request would target the `buscame` parameter, allowing the attacker to manipulate the platform's database. Successful exploitation could lead to unauthorized access and modification of sensitive data.

No authentication or special access is required.
The `buscame` parameter in a POST request triggers the vulnerability.
Risk: Unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

This SQL injection vulnerability in the DRED virtual campus platform could allow an unauthenticated attacker to manipulate database records. By sending a specially crafted POST request to the `/catalogo_c/catalogo.php` endpoint, an attacker could potentially access, alter, or remove data.

Database records at risk.
Via POST request and vulnerable parameter.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in the DRED virtual campus platform likely impacts platform owners or the teams responsible for managing educational technology infrastructure. The initial step should be to confirm the presence and reachability of the affected /catalogo_c/catalogo.php endpoint, identify the accountable application or system owner, and then assess business criticality to prioritize remediation efforts.

Platform owners should manage this vulnerability.
Verify external reachability and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the DRED virtual campus platform?

The DRED virtual campus platform is an educational technology system used to manage academic resources, student information, and campus data. It functions as a web-based application designed to support interactions between students, faculty, and administrative staff by centralizing institutional data.

How does CVE-2025-41009 work?

This CVE is categorized as a SQL Injection (CWE-89) vulnerability. It occurs when an application improperly handles user-provided data, allowing an attacker to inject malicious commands into the database. In this specific case, the flaw allows unauthorized parties to read, modify, or delete sensitive records directly through the system's database.

What triggers the vulnerability in the platform?

The vulnerability is triggered when a specially crafted POST request is sent to the ‘/catalogo_c/catalogo.php’ endpoint targeting the ‘buscame’ parameter. It is important to note that sending standard requests or accessing other parts of the site that do not utilize this specific parameter does not trigger the underlying security flaw.

Is my DRED deployment at risk?

According to Halo Surface Signal, this vulnerability affects web-accessible endpoints. Because DRED is a virtual campus platform intended for internet access, its endpoints are often exposed to the public. If your instance is reachable over the internet, it is considered externally exposed and should be prioritized for review.

What should I do if I run this technology?

First, verify if your environment uses the affected ‘/catalogo_c/catalogo.php’ path. Once identified, coordinate with your system owners to determine the business criticality of the platform. Your goal is to assess the exposure of the database and plan for necessary security updates or configuration changes to mitigate the risk of unauthorized data access.

References

www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-virtual-ca…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.