Portabilis i-Educar Editar educar_instituicao_cad.php cross site scripting

Successful exploitation of CVE-2025-8918 allows an attacker to execute arbitrary JavaScript code in the context of a user's browser session. This can lead to various malicious outcomes, including session hijacking, defacement of the i-Educar interface, and theft of sensitive information like user credentials or personal data. The vulnerability's remote accessibility significantly broadens the potential attack surface, as attackers can initiate the exploit from anywhere with network access to the i-Educar instance. The impact is amplified if the i-Educar system is used to manage sensitive student or institutional data.

Educational institutions and organizations utilizing Portabilis i-Educar for student management or administrative purposes are at risk. Specifically, those running versions 2.0 through 2.10 are vulnerable. Shared hosting environments where multiple i-Educar instances reside on the same server are particularly susceptible, as a compromise of one instance could potentially impact others.

• php: Examine access logs for requests to /intranet/educarinstituicaocad.php containing unusual or suspicious characters in the neighborhood parameter.

 grep 'neighborhood=[^a-zA-Z0-9 ]+' /var/log/apache2/access.log

• generic web: Use curl to test the /intranet/educarinstituicaocad.php endpoint with a simple XSS payload (e.g., <script>alert(1)</script>) in the neighborhood parameter. Monitor browser console for alerts.

curl -X POST -d "neighborhood=<script>alert(1)</script>" http://your-i-educar-instance/intranet/educar_instituicao_cad.php

1. 2025-08-13Disclosure

   disclosure

1. Reservado2025-08-13
2. Publicada2025-08-13
3. EPSS atualizado2026-03-23

The primary mitigation for CVE-2025-8918 is to upgrade i-Educar to version 2.10.1 or later, which includes the necessary fix. If immediate upgrading is not feasible, consider implementing input validation and sanitization on the 'neighborhood name' parameter within the /intranet/educarinstituicaocad.php file. Web application firewalls (WAFs) configured to detect and block XSS payloads targeting this specific endpoint can provide an additional layer of defense. Regularly review and update i-Educar's security configuration to minimize the risk of similar vulnerabilities.