The vulnerability is a classic SQL injection in the /ws/apiprensa/getVideo endpoint where the id_ambito GET parameter is concatenated into a MariaDB query. Because user input is not sanitized and no prepared statements are used, an attacker can inject arbitrary SQL that turns the query into a syntax error, causing a PDOException that leaks database error messages. This exposure allows an attacker to learn database table names, column names, and possibly data content, resulting in information disclosure. The vendor has patched the flaw, and a retest confirms the endpoint is no longer exploitable.

Affected product is the iSquad web service operated by TOOOLS S.L. No specific version information is listed; however the vendor has applied the fix across all production instances and states that no action is required from end users. Users accessing the service through the standardized API endpoint should reliably receive the patched behavior.

The CVSS score of 8.8 classifies the flaw as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the endpoint is reachable over the web, the risk is that a remote attacker could construct a malicious GET request to the /ws/apiprensa/getVideo URL, trigger a syntax error, and harvest database error messages. If the application were still vulnerable, repeated attempts could surface additional database schema details. The vendor’s remediation removes this attack surface; a retest confirms no exploitable behavior; however, absence of EPSS data means the current likelihood of exploitation is unknown.