Platform
php
Component
i-educar
Fixed in
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
CVE-2023-5578 is a cross-site scripting (XSS) vulnerability affecting i-Educar versions 2.7.0 through 2.7.5. This vulnerability allows attackers to inject arbitrary JavaScript code into the application, potentially leading to session hijacking or defacement. The vulnerability resides in the handling of the codagenda parameter within the agendaimprimir.php file. A fix is available in version 2.7.6.
Successful exploitation of CVE-2023-5578 allows an attacker to execute arbitrary JavaScript code in the context of a user's browser. This can lead to the theft of session cookies, enabling the attacker to impersonate the user. The attacker could also modify the content of the page, potentially defacing the website or redirecting users to malicious sites. Given the nature of i-Educar as an educational platform, this could expose sensitive student data or disrupt learning activities. The attack is remotely exploitable, increasing the potential attack surface.
This vulnerability has been publicly disclosed and a proof-of-concept may be available. The CVSS score is LOW (3.5), indicating a relatively low probability of exploitation in most environments. As of the time of this writing, there is no indication of active exploitation campaigns targeting this specific vulnerability. The vulnerability was disclosed to the vendor early, suggesting a proactive response.
Exploit Status
EPSS
0.06% (19% percentile)
CVSS Vector
The primary mitigation for CVE-2023-5578 is to upgrade i-Educar to version 2.7.6 or later, which contains the fix. If upgrading immediately is not possible, consider implementing input validation and output encoding on the codagenda parameter to sanitize user-supplied data. Web application firewalls (WAFs) configured to detect and block XSS payloads targeting GET requests to agendaimprimir.php can provide an additional layer of defense. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload (e.g., <script>alert(1)</script>) through the cod_agenda parameter and verifying that it is properly sanitized or blocked.
Actualice i-Educar a una versión posterior a 2.7.5, si existe, que corrija la vulnerabilidad XSS. Si no hay una versión disponible, revise y filtre las entradas del parámetro 'cod_agenda' en el archivo `intranet\agenda_imprimir.php` para evitar la inyección de código malicioso. Considere implementar una función de escape para los datos de entrada.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2023-5578 is a cross-site scripting (XSS) vulnerability in i-Educar versions 2.7.0–2.7.5, allowing attackers to inject malicious scripts.
You are affected if you are using i-Educar versions 2.7.0 through 2.7.5 and have not yet upgraded to 2.7.6 or later.
Upgrade i-Educar to version 2.7.6 or later. Implement input validation and output encoding as a temporary workaround.
There is no current indication of active exploitation campaigns targeting this specific vulnerability, but a proof-of-concept may be available.
Refer to the Portábilis website or relevant security mailing lists for the official advisory regarding CVE-2023-5578.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.