Portábilis i-Educar HTTP GET Request agenda_imprimir.php cross site scripting

Successful exploitation of CVE-2023-5578 allows an attacker to execute arbitrary JavaScript code in the context of a user's browser. This can lead to the theft of session cookies, enabling the attacker to impersonate the user. The attacker could also modify the content of the page, potentially defacing the website or redirecting users to malicious sites. Given the nature of i-Educar as an educational platform, this could expose sensitive student data or disrupt learning activities. The attack is remotely exploitable, increasing the potential attack surface.

Educational institutions and organizations using i-Educar versions 2.7.0 through 2.7.5 are at risk. Specifically, those with publicly accessible intranet portals or those who do not have robust input validation and output encoding practices in place are particularly vulnerable. Shared hosting environments where multiple users share the same i-Educar instance are also at increased risk.

• php: Examine access logs for requests to agendaimprimir.php with suspicious codagenda parameters containing JavaScript code (e.g., <script>, alert()). • generic web: Use curl to test the agendaimprimir.php endpoint with a simple XSS payload: curl 'http://your-i-educar-instance/intranet/agendaimprimir.php?cod_agenda=<script>alert(1)</script>' and observe the response for the alert box. • generic web: Check response headers for Content-Security-Policy (CSP) directives that might mitigate XSS attacks. Absence of CSP is a potential indicator.

1. 2023-10-14Disclosure

   disclosure

2. 2023-10-14Patch

   patch

1. Reservado2023-10-13
2. Publicada2023-10-14
3. Modificada2024-08-02
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2023-5578 is to upgrade i-Educar to version 2.7.6 or later, which contains the fix. If upgrading immediately is not possible, consider implementing input validation and output encoding on the codagenda parameter to sanitize user-supplied data. Web application firewalls (WAFs) configured to detect and block XSS payloads targeting GET requests to agendaimprimir.php can provide an additional layer of defense. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload (e.g., <script>alert(1)</script>) through the cod_agenda parameter and verifying that it is properly sanitized or blocked.