CVE-2025-10605

Executive Summary

CVE-2025-10605 is a publicly disclosed, unauthenticated Cross-Site Scripting (XSS) vulnerability affecting Portabilis i-Educar up to version 2.10. The flaw resides in the /agenda_preferencias.php file, where the tipoacao parameter is not properly sanitized, allowing an attacker to inject arbitrary JavaScript code. With a CVSS score of 4.3 (Medium), this vulnerability can be exploited remotely without authentication, but requires user interaction (e.g., clicking a crafted link). The exploit has been released to the public, increasing the risk of active exploitation. No official patch has been confirmed at this time.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a malicious link.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The low EPSS score (0.0%) suggests limited active exploitation currently, but the public availability of exploit code and the lack of a patch elevate the risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the agenda_preferencias.php script. The tipoacao parameter is taken directly from the HTTP request and echoed back into the HTML response without proper encoding or validation. An attacker can craft a URL such as:

https://target.com/agenda_preferencias.php?tipoacao=<script>alert('XSS')</script>

When a victim visits this URL, the injected script executes in the context of the victim's browser session, potentially allowing the attacker to steal session cookies, deface the page, or perform actions on behalf of the victim.

The root cause is the lack of output encoding. The application likely uses echo $_GET['tipoacao']; or similar without applying htmlspecialchars() or equivalent sanitization.

Vulnerable vs. Patched Code

Vulnerable Code (i-Educar <= 2.10):

<?php
// agenda_preferencias.php
$tipoacao = $_GET['tipoacao'];
echo "<input type='hidden' name='tipoacao' value='$tipoacao'>";
?>

Patched Code (Hypothetical):

<?php
// agenda_preferencias.php
$tipoacao = htmlspecialchars($_GET['tipoacao'], ENT_QUOTES, 'UTF-8');
echo "<input type='hidden' name='tipoacao' value='$tipoacao'>";
?>

The patched version uses htmlspecialchars() to encode special HTML characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable instance of i-Educar (<= 2.10).
• A web browser or tool like curl.

Exploit Steps:

1. Identify a target running i-Educar.
2. Craft a malicious URL:

   http://target/agenda_preferencias.php?tipoacao=<script>alert(document.cookie)</script>
   

3. Send the link to a victim (e.g., via email or social engineering).
4. When the victim clicks the link, the script executes, and the attacker can capture the cookie via a listener (e.g., using a webhook).

Example using curl to test:

curl -v "http://target/agenda_preferencias.php?tipoacao=<script>alert(1)</script>"

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /agenda_preferencias.php containing suspicious parameters (e.g., <script>, onerror=, javascript:).
• Use WAF rules to block XSS patterns in the tipoacao parameter.

Mitigation:

• Apply input validation and output encoding (see Remediation section).
• Restrict access to the vulnerable script if not needed.
• Educate users about phishing links.

Indicators of Compromise (IOCs)

• URL Pattern: */agenda_preferencias.php?tipoacao=*
• HTTP Request Parameter: tipoacao containing HTML/JavaScript payloads.
• Log Entries: Requests to /agenda_preferencias.php with non-alphanumeric characters in the tipoacao parameter.
• Network Traffic: Outbound connections from the victim's browser to attacker-controlled servers (e.g., for cookie exfiltration).

Detection Engineering

YARA Rule

rule detect_cve_2025_10605_xss {
    meta:
        description = "Detects XSS attempts targeting CVE-2025-10605 in i-Educar"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10605"
    strings:
        $xss_payload = /tipoacao=.*(<script|<img|<svg|onerror=|onload=)/i
    condition:
        $xss_payload
}

Sigma Rule

title: CVE-2025-10605 XSS Attempt in i-Educar
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS attempts targeting the tipoacao parameter in agenda_preferencias.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: '/agenda_preferencias.php'
        cs-uri-query|re: '(?i)tipoacao=.*(<script|<img|<svg|onerror=|onload=)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10605 XSS Attempt in i-Educar"; flow:to_server,established; content:"/agenda_preferencias.php"; http_uri; pcre:"/(?i)tipoacao=.*(<script|<img|<svg|onerror=|onload=)/U"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or restrict access to /agenda_preferencias.php if not required.
2. Implement a Web Application Firewall (WAF) rule to block XSS patterns in the tipoacao parameter.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply output encoding using htmlspecialchars() or equivalent in all PHP files that echo user input.
• Upgrade to a patched version once released by Portabilis.
• Conduct a security audit of the entire application for similar vulnerabilities.

Workaround:

• If patching is not possible, modify the source code to sanitize the tipoacao parameter:

  $tipoacao = htmlspecialchars($_GET['tipoacao'], ENT_QUOTES, 'UTF-8');
  

Valters IT
Securing Digital Frontiers