CVE-2025-10608

Executive Summary

CVE-2025-10608 is a vulnerability in Portabilis i-Educar, an open-source educational management system, affecting versions up to 2.10. The flaw resides in an unknown function within the /enrollment-history/ endpoint, allowing improper access controls. An unauthenticated attacker can remotely manipulate this endpoint to access or modify enrollment history data without proper authorization. The exploit has been publicly disclosed, increasing the risk of active exploitation. The CVSS score of 6.3 (Medium) reflects the potential for confidentiality, integrity, and availability impacts, though the EPSS score is currently 0.0%, indicating low exploitation likelihood at this time. No official patch has been released, making immediate mitigation critical.

Supply Chain & Package Security

i-Educar is a PHP-based application distributed via GitHub and Docker. The vulnerability affects the core application code, not a specific package manager (NPM, PyPI, etc.). However, organizations using Docker images or direct GitHub clones should verify their deployment version and apply workarounds until a patch is available.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited data modification.
• Availability Impact: Low (A:L) – Limited service disruption.

Threat Level: Medium. The public exploit and low attack complexity make this a viable target for opportunistic attackers, though the low EPSS score suggests limited active exploitation currently.

Deep Dive & Mechanics

The vulnerability is an improper access control (CWE-284) in the /enrollment-history/ endpoint of i-Educar. The application fails to enforce authorization checks when processing requests to this endpoint, allowing any unauthenticated user to access or manipulate enrollment history records. The exact function is unknown, but the endpoint likely handles CRUD operations for student enrollment data. By sending crafted HTTP requests, an attacker can bypass intended access restrictions, potentially viewing, modifying, or deleting enrollment records. This could lead to data breaches, academic record tampering, or denial of service.

The exploit is publicly available, though no specific code was provided in the advisory. The attack is straightforward: an HTTP GET or POST request to /enrollment-history/ with manipulated parameters (e.g., id, action) can trigger unauthorized actions.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, the vulnerable code likely lacks an authorization check like:

// Vulnerable: No access control
$enrollmentId = $_GET['id'];
$data = getEnrollmentHistory($enrollmentId);
echo json_encode($data);

A patched version would include:

// Patched: Authorization check
if (!isAuthenticated() || !canAccessEnrollment($_GET['id'])) {
    http_response_code(403);
    exit('Access denied');
}
$enrollmentId = $_GET['id'];
$data = getEnrollmentHistory($enrollmentId);
echo json_encode($data);

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy i-Educar v2.10 using Docker: docker run -d -p 80:80 portabilis/i-educar:2.10
2. Access the application and create a test enrollment record.

Exploitation Steps:

1. Send a GET request to the vulnerable endpoint:

   curl -X GET "http://target/enrollment-history/?id=1"
   

2. If access is granted, attempt to modify data:

   curl -X POST "http://target/enrollment-history/" -d "action=update&id=1&status=inactive"
   

3. Verify unauthorized access by checking the response for enrollment data.

Expected Output: The server returns enrollment history data without authentication, confirming the vulnerability.

Blue Team (Defensive)

Detection:

• Monitor logs for unusual access to /enrollment-history/ from unauthenticated sources.
• Look for repeated requests with varying id parameters (enumeration attempts).
• Alert on POST requests to /enrollment-history/ without a valid session.

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to /enrollment-history/.
• Apply a virtual patch by adding an authorization check in the application code (see patched code example).
• Restrict network access to the application until an official patch is available.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /enrollment-history/ without a valid session cookie.
  • Unusual patterns in id parameter values (e.g., sequential IDs, SQL-like strings).
• Logs:
  • Access logs showing 200 responses to /enrollment-history/ from unknown IPs.
  • Error logs with missing authentication errors (if logging is enabled).
• File System:
  • Modified enrollment records in the database (e.g., unexpected status changes).
• Hashes (if exploit code is available):
  • N/A (no exploit code provided).

Detection Engineering

YARA Rule

rule CVE_2025_10608_iEducar_AccessControl {
    meta:
        description = "Detects exploitation attempts for CVE-2025-10608 in i-Educar"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-10608"
    strings:
        $s1 = "/enrollment-history/" ascii wide nocase
        $s2 = "id=" ascii wide nocase
        $s3 = "action=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-10608 i-Educar Unauthorized Enrollment History Access
id: 8a3f7c2e-5b1d-4a9f-8c6e-2d1f3a4b5c6d
status: experimental
description: Detects unauthenticated access to /enrollment-history/ endpoint in i-Educar
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-stem: "/enrollment-history/"
        sc-status: 200
    filter:
        c-useragent: "Mozilla/5.0*"  # Adjust based on legitimate user agents
    condition: selection and not filter
falsepositives:
    - Legitimate authenticated users (if user agent matches)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10608 i-Educar Unauthorized Enrollment History Access"; flow:to_server; content:"/enrollment-history/"; http_uri; nocase; content:"id="; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Restrict access to /enrollment-history/ via web server configuration (e.g., .htaccess for Apache):

   <Location "/enrollment-history/">
       Require all denied
   </Location>
   

2. Short-term: Implement authentication checks in the application code (see patched code example).
3. Long-term: Monitor the Portabilis GitHub repository for an official patch and apply it promptly.
4. Compensating Controls: Use a WAF to block unauthenticated requests to the vulnerable endpoint.
5. Monitoring: Enable detailed logging for /enrollment-history/ and review logs for suspicious activity.

Valters IT
Securing Digital Frontiers