CVE-2025-11048
📋 TL;DR
This vulnerability allows attackers to bypass authorization controls in Portabilis i-Educar's /consulta-dispensas endpoint, potentially accessing unauthorized data or functions. It affects i-Educar versions up to 2.10 and can be exploited remotely by authenticated users with lower privileges.
💻 Affected Systems
- Portabilis i-Educar
📦 What is this software?
I Educar by Portabilis
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users gain administrative access to sensitive student data, modify academic records, or disrupt educational operations.
Likely Case
Attackers access confidential student information or perform unauthorized actions within their authenticated privilege level.
If Mitigated
Limited impact with proper network segmentation, strong authentication, and monitoring in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub. Requires authenticated access but minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.11 or later
Vendor Advisory: https://github.com/portabilis/i-educar
Restart Required: No
Instructions:
1. Backup your i-Educar installation and database. 2. Update to i-Educar version 2.11 or later. 3. Verify the /consulta-dispensas endpoint now properly enforces authorization checks.
🔧 Temporary Workarounds
Block vulnerable endpoint
allTemporarily block access to the /consulta-dispensas endpoint using web server configuration or WAF rules.
# Apache: RewriteRule ^/consulta-dispensas - [F]
# Nginx: location /consulta-dispensas { deny all; }
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the i-Educar application.
- Enhance monitoring and alerting for unauthorized access attempts to the /consulta-dispensas endpoint.
🔍 How to Verify
Check if Vulnerable:
Test if authenticated users with limited privileges can access the /consulta-dispensas endpoint and perform actions beyond their role.Check Version:
Check i-Educar version in admin panel or configuration files.Verify Fix Applied:
After patching, verify that authorization checks are properly enforced on the /consulta-dispensas endpoint for all user roles.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authorization attempts followed by successful access to /consulta-dispensas
- User accounts accessing /consulta-dispensas endpoint without proper role permissions
Network Indicators:
- Unusual patterns of requests to /consulta-dispensas endpoint from non-admin users
SIEM Query:
source="web_logs" AND uri="/consulta-dispensas" AND user_role!="admin"🔗 References
- https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Access%20Control%20%20in%20%60.consulta-dispensas%60%20Endpoint.md
- https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-11048.md
- https://vuldb.com/?ctiid.326085
- https://vuldb.com/?id.326085
- https://vuldb.com/?submit.659202
- https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-11048.md
- https://vuldb.com/?submit.659202
