Executive brief
iSquad is a sports analytics platform that combines Big Data and AI for comprehensive sports management. The '/ws/apiprensa/getVideoNextPrev' endpoint contains an SQL injection vulnerability via unsanitized input in the id_ambito parameter, allowing attackers to inject SQL commands that disrupt database queries and expose internal database structure and error messages. This information disclosure could facilitate further attacks against the system.
Technical details
CVE-2026-81674 is an error-based SQL injection vulnerability in the '/ws/apiprensa/getVideoNextPrev' endpoint caused by improper input validation of the id_ambito parameter. Unsanitized user input is directly concatenated into a MariaDB SQL query without use of prepared statements or parameterized queries. A remote, unauthenticated attacker can send malicious SQL syntax via the id_ambito parameter to interrupt query execution, triggering database error messages that expose internal query structure and implementation details. The vulnerability enables information disclosure through detailed error messages; a patch has been deployed by TOOOLS across all production instances.
Affected products
- TOOOLS iSquad prior to July 22, 2026
Timeline
- 2026-08-27: disclosed: Coordinated disclosure by INCIBE
- 2026-07-22: patched: Fix deployed by TOOOLS across all production instances