CVE-2025-8367
📋 TL;DR
A reflected cross-site scripting (XSS) vulnerability exists in Portabilis i-Educar 2.9 where the 'nome' parameter in /intranet/funcionario_vinculo_lst.php is not properly sanitized. This allows attackers to inject malicious scripts that execute in victims' browsers when they visit a crafted URL. Organizations running i-Educar 2.9 are affected.
💻 Affected Systems
- Portabilis i-Educar
📦 What is this software?
I Educar by Portabilis
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or deface the application interface.
Likely Case
Session hijacking leading to unauthorized access to student/employee data, or credential theft through phishing-style attacks.
If Mitigated
Limited impact if proper input validation, output encoding, and Content Security Policy are implemented.
🎯 Exploit Status
Exploit requires user interaction (clicking malicious link) but is trivial to craft.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Implement workarounds or upgrade if newer version exists.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize the 'nome' parameter before processing.
Edit /intranet/funcionario_vinculo_lst.php to filter/escape user input
Web Application Firewall Rule
allBlock requests containing script tags or XSS patterns in the nome parameter.
WAF specific configuration required
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Restrict access to /intranet/funcionario_vinculo_lst.php endpoint via network controls
🔍 How to Verify
Check if Vulnerable:
Test by accessing /intranet/funcionario_vinculo_lst.php?nome=<script>alert('XSS')</script> and checking if script executes.Check Version:
Check i-Educar version in admin panel or configuration files.Verify Fix Applied:
Retest with same payload; script should not execute and input should be properly encoded.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to funcionario_vinculo_lst.php with script tags or encoded payloads in parameters
Network Indicators:
- Unusual parameter values in GET requests to vulnerable endpoint
SIEM Query:
source="web_logs" AND uri_path="/intranet/funcionario_vinculo_lst.php" AND (query_string CONTAINS "<script>" OR query_string CONTAINS "javascript:")