CVE-2025-10607

Executive Summary

CVE-2025-10607 is a publicly disclosed information disclosure vulnerability affecting Portabilis i-Educar, an open-source educational management system, up to version 2.10. The flaw resides in the /module/Avaliacao/diarioApi endpoint, where an unknown function exposes sensitive data without proper authorization. With a CVSS score of 4.3 (Medium), the vulnerability is remotely exploitable without authentication, posing a risk to confidentiality. No official patch has been released, and a proof-of-concept (PoC) is publicly available, increasing the urgency for defensive measures.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a direct code-level flaw in the i-Educar PHP application. However, organizations using i-Educar should verify the integrity of their deployment and monitor for any third-party dependencies that may be affected.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The low attack complexity and public PoC make this a realistic threat for unpatched instances. The EPSS score of 0.0% suggests low exploitation activity currently, but this may change as awareness grows.

Deep Dive & Mechanics

The vulnerability is located in the /module/Avaliacao/diarioApi endpoint of i-Educar. This endpoint is part of the assessment (Avaliacao) module and likely handles API requests for diary or grade-related data. The exact function is unknown, but the flaw allows an unauthenticated attacker to retrieve sensitive information, such as student records, grades, or internal configuration data.

The root cause is a lack of proper access controls or input validation on the API endpoint. The application fails to verify the user's identity or permissions before processing the request, leading to unauthorized data exposure. The attack is performed via a simple HTTP GET or POST request to the vulnerable URL.

Vulnerable vs. Patched Code

Since no official patch is available, a direct code comparison cannot be provided. However, the vulnerable code likely resembles:

// Vulnerable: No authentication check
public function diarioApi() {
    $data = $this->getSensitiveData();
    return $this->jsonResponse($data);
}

A patched version would include authentication and authorization checks:

// Patched: Requires authentication and authorization
public function diarioApi() {
    if (!$this->isAuthenticated() || !$this->isAuthorized('view_diary')) {
        return $this->jsonResponse(['error' => 'Unauthorized'], 403);
    }
    $data = $this->getSensitiveData();
    return $this->jsonResponse($data);
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy i-Educar 2.10 in a Docker container or on a local server.
2. Ensure the application is accessible via HTTP.

Exploitation Steps:

1. Send a GET request to the vulnerable endpoint:

   curl -X GET "http://target/module/Avaliacao/diarioApi"
   

2. Observe the response for sensitive data (e.g., JSON containing student info, grades, or tokens).
3. If the endpoint requires parameters, attempt common ones like id, aluno, or turma.

Example PoC (if available):

curl -v "http://target/module/Avaliacao/diarioApi?aluno=1"

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /module/Avaliacao/diarioApi from unauthenticated sources.
• Look for unusual data volume in responses from this endpoint.

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block access to the vulnerable path.
• Apply virtual patching by adding authentication checks via a reverse proxy (e.g., Nginx auth_request).

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /module/Avaliacao/diarioApi with no session cookie or authorization header.
  • Responses containing JSON with fields like aluno, nota, turma, or matricula.
• File System:
  • Unusual access logs in /var/log/nginx/access.log or Apache logs showing the vulnerable path.
• Behavioral:
  • Anomalous data exfiltration patterns from the i-Educar server.

Detection Engineering

YARA Rule

rule CVE_2025_10607_iEducar_InfoDisclosure {
    meta:
        description = "Detects requests to the vulnerable i-Educar diarioApi endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10607"
    strings:
        $endpoint = "/module/Avaliacao/diarioApi"
        $json_response = /{"[^"]+":\s*"[^"]*"}/
    condition:
        $endpoint and $json_response
}

Sigma Rule

title: CVE-2025-10607 i-Educar Information Disclosure Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests to the vulnerable i-Educar diarioApi endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-stem: "/module/Avaliacao/diarioApi"
    condition: selection
falsepositives:
    - Legitimate authenticated users (if any)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10607 i-Educar Information Disclosure Attempt"; flow:to_server; content:"/module/Avaliacao/diarioApi"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint by removing or commenting out the route in the application code.
2. Implement authentication for the /module/Avaliacao/diarioApi endpoint using middleware or a reverse proxy.
3. Apply a WAF rule to block requests to this path from untrusted sources.

Long-Term Fix:

• Monitor the Portabilis repository for an official patch and apply it as soon as available.
• Conduct a security audit of all API endpoints in i-Educar to ensure proper access controls.
• Consider upgrading to a newer version if a patch is released.

Workaround:

• If patching is not possible, restrict network access to the i-Educar server using a firewall or VPN.

Valters IT