Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind SQL Injection.This issue affects EduAdmin Booking: from n/a before 6.0.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-10-09T10:16:45.980Z",
  "pubdate": "2026-10-09T10:16:45.980Z",
  "executiveSummary": "EduAdmin Booking by MultiNet Interactive AB is susceptible to a Blind SQL Injection vulnerability, categorized under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.\nThe vulnerability exists due to insufficient sanitization of user-supplied input before it is processed within backend SQL queries.\nAn unauthenticated or authenticated attacker can leverage this flaw to perform data exfiltration by observing the application's response behavior to crafted malicious queries.\nThe impact includes unauthorized access to sensitive database information, potential data manipulation, and compromise of the underlying database integrity.\nThis issue affects all versions of EduAdmin Booking prior to version 6.0.0.\nOrganizations using affected versions are at significant risk of database breaches and should prioritize upgrading to version 6.0.0 or higher to remediate this security flaw.",
  "technicalDetails": "The core of the vulnerability resides in the application's handling of user-controlled parameters that are passed to database queries without adequate parameterized queries or prepared statements.\nBecause the application is vulnerable to Blind SQL Injection, the attacker cannot retrieve data directly through the standard HTTP response body. Instead, the attacker must infer database contents by asking the database true/false questions based on the application's response (Boolean-based) or by measuring the time taken for the server to respond (Time-based).\nThe attack flow begins with the identification of an entry point where user input influences a SQL query's logic. An attacker injects SQL fragments designed to alter the query's boolean logic (e.g., adding 'AND 1=1' or 'AND 1=0') or induce artificial delays (e.g., using sleep functions in SQL) based on specific conditions.\nBy observing whether the application returns a successful response or indicates an error/different content, the attacker can systematically extract data, one bit or character at a time, from the backend database schema, table names, and record values.\nThis vulnerability is particularly dangerous because it does not require administrative privileges and can be executed remotely over the network. The lack of proper input neutralization allows for the execution of arbitrary SQL commands, effectively bypassing existing application-level authentication mechanisms to reach the data layer.\nAffected component: EduAdmin Booking application logic interacting with the database. Versions affected: all iterations prior to 6.0.0.\nPost-exploitation, an attacker can utilize these techniques to enumerate the entire database content, identify user credentials, or extract administrative configurations, leading to a complete compromise of the data managed by the EduAdmin Booking system."
}