CVE-2025-9638
📋 TL;DR
This stored XSS vulnerability in Portabilis i-Educar allows attackers to inject malicious scripts via the matricula_interna parameter, which are then executed when other users view affected pages. It affects all users of i-Educar version 2.10.0, potentially compromising user sessions and data.
💻 Affected Systems
- Portabilis i-Educar
📦 What is this software?
I Educar by Portabilis
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, hijack user sessions, deface the application, or redirect users to malicious sites, potentially leading to complete system compromise.
Likely Case
Session hijacking, credential theft, and unauthorized actions performed on behalf of legitimate users.
If Mitigated
Limited to minor data exposure or temporary session disruption if proper input validation and output encoding are implemented.
🎯 Exploit Status
Exploitation requires access to the vulnerable endpoint, but the XSS payload is straightforward to craft.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check Portabilis GitHub for security updates. 2. Apply any available patches. 3. Validate input sanitization in educar_usuario_cad.php.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to sanitize the matricula_interna parameter
Modify educar_usuario_cad.php to filter/escape HTML special characters in matricula_interna
WAF Rule
allDeploy web application firewall rules to block XSS payloads
Configure WAF to detect and block scripts in matricula_interna parameter
🧯 If You Can't Patch
- Restrict access to educar_usuario_cad.php endpoint to authorized users only
- Implement Content Security Policy (CSP) headers to mitigate script execution
🔍 How to Verify
Check if Vulnerable:
Test by submitting a script payload (e.g., <script>alert('XSS')</script>) to the matricula_interna parameter in educar_usuario_cad.php and check if it executes when viewed.Check Version:
Check i-Educar version in admin panel or configuration filesVerify Fix Applied:
Re-test with the same payload after applying fixes; script should not execute and should be properly encoded in output.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to educar_usuario_cad.php with script-like content in parameters
- Multiple failed login attempts followed by successful access to vulnerable endpoint
Network Indicators:
- HTTP requests containing script tags or JavaScript in matricula_interna parameter
- Unusual outbound connections from i-Educar server after XSS payload execution
SIEM Query:
source="web_logs" AND uri="/educar_usuario_cad.php" AND (param="matricula_interna" AND value MATCHES "<script|javascript:")