CVE-2025-11554

Executive Summary

CVE-2025-11554 is a security vulnerability affecting Portabilis i-Educar, an open-source educational management system, up to version 2.9.10. The flaw resides in the app/Http/Controllers/AccessLevelController.php file, specifically within the User Type Handler component. The vulnerability allows for insecure inherited permissions, enabling a remote attacker with low privileges to manipulate access controls and escalate their privileges. This can lead to unauthorized access to sensitive data, modification of system configurations, and potential lateral movement within the network. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch has been released at this time.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the i-Educar PHP application. The risk is primarily to organizations that have deployed i-Educar in their environment.

CVSS Breakdown & Threat Level

CVSS Score: 6.3 (Medium)

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

• Attack Vector (AV): Network (N) - The attack can be executed remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions or complex attack sequences are required.
• Privileges Required (PR): Low (L) - The attacker needs a valid low-privileged user account.
• User Interaction (UI): None (N) - No user action is required to trigger the exploit.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the security scope of the vulnerable component.
• Confidentiality (C): Low (L) - Limited information disclosure is possible.
• Integrity (I): High (H) - The attacker can significantly modify data or system configurations.
• Availability (A): Low (L) - The attack could cause a minor degradation of service.

Threat Level: High. The combination of a public exploit, low attack complexity, and potential for privilege escalation makes this a significant threat to unpatched i-Educar instances.

Deep Dive & Mechanics

The vulnerability is located in the AccessLevelController.php file, which handles user type and permission management. The core issue is an insecure inherited permissions flaw (CWE-277). This occurs when the application fails to properly validate or restrict the inheritance of permissions from a parent user type or role to a child user type.

In i-Educar, user types (e.g., Admin, Teacher, Student) have associated permissions. The vulnerable code likely allows a low-privileged user (e.g., a Teacher) to create or modify a new user type that inherits permissions from a higher-privileged type (e.g., Admin) without proper authorization checks. This can be achieved by manipulating HTTP requests to the AccessLevelController endpoint.

The attack flow is as follows:

1. An attacker authenticates as a low-privileged user (e.g., a Teacher).
2. The attacker sends a crafted HTTP request to the endpoint responsible for creating or editing user types (likely /access-level or similar).
3. The request includes parameters that specify a parent user type with higher privileges (e.g., parent_id=1 for Admin).
4. The vulnerable code does not verify if the current user has the right to assign such permissions, leading to the creation of a new user type with inherited Admin-level permissions.
5. The attacker can then assign this new user type to their account or a new account, effectively escalating their privileges.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical analysis based on the vulnerability description.

Vulnerable Code (Conceptual):

// app/Http/Controllers/AccessLevelController.php
public function store(Request $request) {
    $userType = new UserType();
    $userType->name = $request->input('name');
    $userType->parent_id = $request->input('parent_id'); // No authorization check
    $userType->save();
    // ... assign permissions based on parent
}

Patched Code (Conceptual):

// app/Http/Controllers/AccessLevelController.php
public function store(Request $request) {
    $this->authorize('create', UserType::class); // Ensure user has permission to create types
    $parentType = UserType::findOrFail($request->input('parent_id'));
    $this->authorize('assign', $parentType); // Ensure user can assign this parent type
    $userType = new UserType();
    $userType->name = $request->input('name');
    $userType->parent_id = $parentType->id;
    $userType->save();
    // ... assign permissions based on parent
}

The patched version would include proper authorization checks using Laravel's policies or middleware to ensure the current user has the necessary permissions to create a new user type and to assign a specific parent type.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable instance of i-Educar 2.9.10 using Docker or a manual LAMP stack.
2. Create a low-privileged user account (e.g., Teacher).
3. Obtain a valid session cookie for this user.

Exploitation Steps:

1. Intercept a request to create a new user type using a tool like Burp Suite.
2. Modify the request to include a parent_id parameter pointing to an Admin user type (e.g., parent_id=1).
3. Send the crafted request.
4. Verify the new user type has inherited Admin permissions.
5. Assign this new user type to your low-privileged account or create a new account with it.
6. Access restricted areas or perform administrative actions.

Example HTTP Request (POST):

POST /access-level HTTP/1.1
Host: target-ieducar.local
Content-Type: application/x-www-form-urlencoded
Cookie: laravel_session=your_session_cookie

name=HackerType&parent_id=1&_token=csrf_token

Blue Team

Detection Steps:

1. Monitor for unusual user type creation or modification events in application logs.
2. Look for HTTP requests to /access-level or similar endpoints with unexpected parent_id values.
3. Alert on any user type being created by a low-privileged user.
4. Review user accounts for unexpected privilege escalations.
5. Implement strict access controls on user type management endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /access-level or /user-type endpoints with parent_id parameter.
  • Unusual user agent strings or IP addresses accessing administrative endpoints.
• Host IOCs:
  • New user types created in the database with names like "HackerType" or similar.
  • User accounts with unexpected elevated permissions.
  • Modified files in app/Http/Controllers/AccessLevelController.php (if attacker patches).
• Log IOCs:
  • Application logs showing creation of user types by non-admin users.
  • Authentication logs showing privilege escalation events.

Detection Engineering

YARA Rule

rule Detect_iEducar_Insecure_Inherited_Permissions {
    meta:
        description = "Detects potential exploitation of CVE-2025-11554 in i-Educar"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11554"
    strings:
        $s1 = "parent_id" ascii wide nocase
        $s2 = "AccessLevelController" ascii wide nocase
        $s3 = "store" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Detection of CVE-2025-11554 Exploitation Attempts
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests attempting to exploit insecure inherited permissions in i-Educar
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/access-level'
            - '/user-type'
        cs-uri-query:
            - '*parent_id*'
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11554 i-Educar Insecure Inherited Permissions Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/access-level"; http_uri; content:"parent_id"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Vulnerable Systems: If possible, isolate i-Educar instances from the internet and untrusted networks.
2. Disable User Type Management: Temporarily disable the user type creation/modification functionality by removing or renaming the AccessLevelController.php file or restricting access via .htaccess or web server configuration.
3. Review User Accounts: Audit all user accounts for unexpected privilege escalations and revoke any suspicious permissions.

Long-Term Fixes:

1. Apply Official Patch: Monitor the Portabilis i-Educar GitHub repository for an official patch and apply it as soon as it is released.
2. Implement Custom Patch: If no official patch is available, implement the conceptual patch described in the "Vulnerable vs. Patched Code" section. Add authorization checks using Laravel's built-in policies.
3. Upgrade: Upgrade to a patched version of i-Educar once available.

Compensating Controls:

1. Web Application Firewall (WAF): Deploy a WAF with rules to block requests containing parent_id in the body for non-admin users.
2. Network Segmentation: Place i-Educar in a segmented network with strict access controls.
3. Enhanced Logging: Enable detailed logging for all user type management actions and monitor for anomalies.

Valters IT