CVE-2025-9107
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into the Portabilis i-Diario web application through the search_autocomplete endpoint. When exploited, it enables cross-site scripting attacks that can steal user sessions, redirect users, or deface the application. All users of i-Diario versions up to 1.5.0 are affected.
💻 Affected Systems
- Portabilis i-Diario
📦 What is this software?
I Diario by Portabilis
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator credentials, gain full control of the application, and compromise sensitive student data.
Likely Case
Attackers steal user session cookies to impersonate legitimate users and access their data.
If Mitigated
Script execution is blocked by Content Security Policy or input validation, limiting impact to minor UI disruption.
🎯 Exploit Status
Exploit requires no authentication and proof-of-concept is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider upgrading to latest version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize the 'q' parameter in /alunos/search_autocomplete endpoint
Implement HTML entity encoding for user input
Use framework-specific XSS protection libraries
Web Application Firewall Rule
allDeploy WAF rules to block XSS payloads in the search_autocomplete endpoint
Add WAF rule: Detect and block scripts in 'q' parameter
Configure regex pattern: /<script.*?>.*?<\/script>/i
🧯 If You Can't Patch
- Implement Content Security Policy headers to restrict script execution
- Restrict access to /alunos/search_autocomplete endpoint to authenticated users only
🔍 How to Verify
Check if Vulnerable:
Test the /alunos/search_autocomplete endpoint with XSS payload in 'q' parameter and check if script executesCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Test with same XSS payloads and verify scripts are properly sanitized or blocked📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /alunos/search_autocomplete with script tags
- Multiple failed login attempts following XSS payload requests
Network Indicators:
- HTTP requests containing <script> tags in query parameters
- Unusual outbound connections from application to external domains
SIEM Query:
source="web_logs" AND uri_path="/alunos/search_autocomplete" AND (query="*<script*" OR query="*javascript:*")🔗 References
- https://github.com/marcelomulder/CVE/blob/main/i-diario/CVE-2025-9107.md
- https://github.com/marcelomulder/CVE/blob/main/i-diario/Reflected%20XSS%20endpoint%20search_autocomplete%20parameter%20q.md#poc
- https://vuldb.com/?ctiid.320429
- https://vuldb.com/?id.320429
- https://vuldb.com/?submit.627568
- https://github.com/marcelomulder/CVE/blob/main/i-diario/CVE-2025-9107.md
- https://vuldb.com/?submit.627568
