CVE-2025-10073
📋 TL;DR
This vulnerability in Portabilis i-Educar allows unauthorized access to class information through the /module/Api/turma endpoint. Attackers can exploit this broken object level authorization (BOLA) to enumerate sensitive educational data. All i-Educar installations up to version 2.10 are affected.
💻 Affected Systems
- Portabilis i-Educar
📦 What is this software?
I Educar by Portabilis
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized disclosure of all class information including student data, schedules, and educational records, potentially leading to privacy violations and data breaches.
Likely Case
Attackers enumerate class information and student details, compromising student privacy and potentially enabling further attacks.
If Mitigated
Limited information disclosure with proper access controls and monitoring in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub. Attack requires some level of access but authorization bypass is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.11 or later
Vendor Advisory: https://github.com/portabilis/i-educar
Restart Required: No
Instructions:
1. Update i-Educar to version 2.11 or later. 2. Apply the security patch from the official repository. 3. Verify the /module/Api/turma endpoint now properly validates authorization.
🔧 Temporary Workarounds
Restrict API Access
LinuxImplement network-level restrictions to limit access to the vulnerable API endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "/module/Api/turma" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "/module/Api/turma" --algo bm -j DROP
Implement API Gateway Controls
allAdd authorization checks at the API gateway level
🧯 If You Can't Patch
- Implement strict access controls and monitoring for the /module/Api/turma endpoint
- Deploy a web application firewall (WAF) with rules to detect and block BOLA attacks
🔍 How to Verify
Check if Vulnerable:
Test if unauthorized access to /module/Api/turma endpoint returns class information without proper authenticationCheck Version:
Check i-Educar version in admin panel or configuration filesVerify Fix Applied:
Verify that accessing /module/Api/turma without proper authorization returns an access denied error📡 Detection & Monitoring
Log Indicators:
- Multiple unauthorized requests to /module/Api/turma
- Access patterns showing enumeration of class IDs
Network Indicators:
- Unusual API traffic to the turma endpoint
- Sequential requests with different ID parameters
SIEM Query:
source="web_server" AND uri="/module/Api/turma" AND (response_code=200 OR response_code=403) | stats count by src_ip🔗 References
- https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Object%20Level%20Authorization%20(BOLA)%20allows%20enumeration%20of%20classes%20informations%20via%20.module.Api.turma.md
- https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10073.md
- https://vuldb.com/?ctiid.323021
- https://vuldb.com/?id.323021
- https://vuldb.com/?submit.644136
