CVE-2025-10606: Portabilis I-educar XSS Vulnerability

CVE-2025-10606 Overview

CVE-2025-10606 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Portabilis i-Educar through version 2.10. The flaw resides in the /module/Configuracao/ConfiguracaoMovimentoGeral endpoint, where the tipoacao parameter is reflected in server responses without proper output encoding. A remote attacker can craft a malicious URL that, when opened by an authenticated user, executes arbitrary JavaScript in the victim's browser session. Public proof-of-concept material has been published, increasing the likelihood of opportunistic exploitation against exposed deployments.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of an authenticated i-Educar session, enabling session data theft, unauthorized actions in the school management platform, and phishing against staff or students.

Affected Products

Portabilis i-Educar versions up to and including 2.10
Deployments exposing the /module/Configuracao/ConfiguracaoMovimentoGeral module
Web-facing i-Educar instances accessible to authenticated users

Discovery Timeline

2025-09-17 - CVE-2025-10606 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10606

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the configuration module of i-Educar, a school management platform used by educational institutions. The application accepts the tipoacao (action type) parameter and echoes its value back into the HTTP response without sanitizing or HTML-encoding user-controlled content. Attackers weaponize this by embedding JavaScript payloads in the parameter and delivering the crafted URL through phishing emails, chat messages, or malicious links.

Exploitation requires user interaction, but the attack surface is broad because staff frequently follow administrative links to configuration modules. Successful execution runs in the victim's browser context, granting the attacker access to session cookies, CSRF tokens, and any data rendered in the DOM.

Root Cause

The root cause is missing output encoding on the tipoacao request parameter within the ConfiguracaoMovimentoGeral handler. Input taken from the query string is rendered directly into HTML without contextual escaping, violating standard defenses against script injection.

Attack Vector

The vector is network-based and requires user interaction. An attacker sends a target a URL containing a JavaScript payload in the tipoacao parameter. When the authenticated victim loads the URL, the injected script executes with the privileges of the user. See the GitHub XSS Vulnerability Report for the parameter details and the GitHub PoC Repository for the disclosed proof-of-concept.

Detection Methods for CVE-2025-10606

Indicators of Compromise

HTTP requests to /module/Configuracao/ConfiguracaoMovimentoGeral containing tipoacao values with <script>, javascript:, onerror=, or onload= substrings.
URL-encoded payload markers such as %3Cscript%3E, %3Cimg, or %3Csvg in the tipoacao parameter.
Referrer headers from unexpected external domains pointing to the vulnerable configuration endpoint.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the tipoacao parameter for HTML tag characters and common XSS payload keywords.
Enable verbose access logging on the i-Educar web server and search historical logs for suspicious query strings referencing ConfiguracaoMovimentoGeral.
Correlate outbound requests from user browsers to unfamiliar domains immediately after visits to the configuration endpoint, which may indicate cookie exfiltration.

Monitoring Recommendations

Alert on any request to /module/Configuracao/ConfiguracaoMovimentoGeral where tipoacao contains angle brackets, quotes, or event-handler patterns.
Track authenticated session anomalies such as concurrent geolocations or unexpected privilege changes following configuration module access.
Review browser Content Security Policy (CSP) violation reports for inline script execution originating from i-Educar pages.

How to Mitigate CVE-2025-10606

Immediate Actions Required

Upgrade Portabilis i-Educar to a version later than 2.10 once a fixed release is available from the vendor.
Restrict access to the /module/Configuracao/ConfiguracaoMovimentoGeral endpoint to trusted administrative networks via IP allowlisting.
Instruct users to avoid clicking on unsolicited i-Educar links and to log out of the platform when not in active use.

Patch Information

No vendor advisory URL is currently referenced in the NVD entry. Consult the Portabilis i-Educar project channels and the VulDB entry #324626 for updates on remediation status. Track upstream releases and apply the fixed version as soon as it is published.

Workarounds

Deploy WAF signatures that block requests where the tipoacao parameter contains characters such as <, >, ", ', or common event-handler tokens.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins to reduce the impact of injected payloads.
Configure session cookies with the HttpOnly and SameSite=Strict attributes to limit script access to session identifiers.

bash

# Example nginx rule to block XSS patterns in the tipoacao parameter
if ($args ~* "tipoacao=.*(<|%3C|script|onerror|onload|javascript:)") {
    return 403;
}