CVE-2026-81677: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') in TOOOLS iSquad

The vulnerability CVE-2026-81677 affects the TOOOLS iSquad product. It is an SQL injection (CWE-89) vulnerability located in the '/ws/apiprensa/getVideo' endpoint. The GET parameter 'id_ambito' is not properly validated, enabling an attacker to inject malicious SQL code. This injection breaks the underlying MariaDB query syntax, resulting in syntax errors and the exposure of database error messages through PDOException. This confirms that user input is directly embedded into SQL queries without adequate sanitization or the use of parameterized queries.

Successful exploitation can lead to the exposure of database error messages, which may aid attackers in crafting further attacks. The vulnerability could potentially allow attackers to manipulate SQL queries, leading to unauthorized data access or other impacts typical of SQL injection flaws. However, no known exploits in the wild have been reported at this time.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider implementing input validation and sanitization on the 'id_ambito' parameter and avoid direct incorporation of user input into SQL queries. Use of prepared statements or parameterized queries is recommended as a best practice.