Portabilis i-Educar User Data meusdadod.php cross site scripting

Successful exploitation of CVE-2026-2064 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to various malicious actions, including session hijacking, credential theft, and redirection to phishing sites. The attacker could potentially steal sensitive information displayed within the i-Educar interface, such as student records or administrative data. Given the publicly available exploit, the risk of exploitation is elevated, particularly for systems that have not been patched. The attack can be launched remotely, expanding the potential attack surface.

Educational institutions and organizations utilizing Portabilis i-Educar for student data management are at risk. Specifically, deployments running versions 2.0 through 2.10 are vulnerable. Shared hosting environments where i-Educar is installed may be particularly susceptible due to limited control over server configurations.

• php / web: Examine access logs for requests to /intranet/meusdadod.php with unusual or suspicious parameters in the 'File' argument. Look for patterns indicative of XSS payloads (e.g., <script> tags, event handlers). • generic web: Use curl or wget to test the /intranet/meusdadod.php endpoint with a simple XSS payload (e.g., <script>alert('XSS')</script>). Observe the response for script execution. • generic web: Check response headers for Content-Security-Policy (CSP) directives. A strong CSP can mitigate XSS even if the vulnerability exists.

1. 2026-02-06Disclosure

   disclosure

1. Gereserveerd2026-02-06
2. Gepubliceerd2026-02-06
3. Gewijzigd2026-02-23
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2026-2064 is to upgrade Portabilis i-Educar to version 2.10 or later, which contains the fix. If upgrading immediately is not feasible, consider implementing input validation and sanitization on the 'File' argument within the /intranet/meusdadod.php file to prevent malicious script injection. Web application firewalls (WAFs) can be configured to detect and block XSS attempts targeting this specific endpoint. Regularly review and update WAF rules to ensure effectiveness. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload into the 'File' parameter and verifying that the script is not executed.