CVE-2025-7111: Portabilis I-educar XSS Vulnerability

CVE-2025-7111 Overview

CVE-2025-7111 is a reflected cross-site scripting (XSS) vulnerability in Portabilis i-Educar 2.9.0. The flaw resides in the Course Module, specifically the /intranet/educar_curso_det.php endpoint. Attackers can manipulate the Curso argument through the cod_curso parameter to inject arbitrary JavaScript. The exploit has been publicly disclosed and can be triggered remotely with low-privilege authentication and user interaction. The vendor was contacted prior to disclosure but did not respond. This weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation enables session-context script execution against authenticated i-Educar users, which can be leveraged to hijack sessions, deface content, or pivot within the education management platform.

Affected Products

Portabilis i-Educar 2.9.0
Component: Course Module (educar_curso_det.php)
Parameter: cod_curso (Curso argument)

Discovery Timeline

2025-07-07 - CVE-2025-7111 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7111

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the Course Module of Portabilis i-Educar 2.9.0. The educar_curso_det.php script accepts the cod_curso GET parameter without proper output encoding. When the value of that parameter is rendered back in the HTTP response, an attacker-controlled payload executes in the victim's browser session.

Exploitation requires an authenticated user to visit a crafted URL. Because i-Educar is a school management platform, victim accounts often hold administrative or teacher-level access. Script execution in that context can expose gradebook data, student records, and administrative functions.

Additional technical detail is available in the VulDB entry #315022 and the public proof-of-concept.

Root Cause

The root cause is missing input validation and output sanitization on the cod_curso parameter. User-supplied data flows into the HTML response without HTML entity encoding or context-aware escaping. This omission violates standard defenses against [CWE-79] and allows arbitrary HTML and JavaScript to be reflected into the page.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a malicious link containing the XSS payload in the cod_curso parameter and delivers it through phishing, chat, or a compromised page. When an authenticated i-Educar user clicks the link, the injected script executes under the origin of the i-Educar deployment. Attackers can then steal session cookies, submit CSRF-style actions, or capture keystrokes within the application.

No verified exploit code is included here. The public proof-of-concept demonstrating the parameter manipulation is hosted at the PoCVulDb repository.

Detection Methods for CVE-2025-7111

Indicators of Compromise

HTTP GET requests to /intranet/educar_curso_det.php where cod_curso contains characters such as <, >, ", ', or the strings script, onerror, onload, or javascript:.
Referer headers on i-Educar sessions originating from external or untrusted domains combined with suspicious query strings.
Anomalous session activity from teacher or administrator accounts shortly after clicking external links.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that flags reflected script content in the cod_curso query parameter.
Enable request logging on the i-Educar web server and grep for educar_curso_det.php requests containing URL-encoded angle brackets (%3C, %3E).
Correlate outbound web traffic from user browsers with anomalous cookie exfiltration destinations following i-Educar access.

Monitoring Recommendations

Forward web server access logs to a centralized logging or SIEM platform and alert on payload signatures targeting cod_curso.
Monitor Content Security Policy (CSP) violation reports if CSP is enabled on the i-Educar deployment.
Track authentication events for privileged i-Educar accounts and investigate session token reuse from new IP addresses.

How to Mitigate CVE-2025-7111

Immediate Actions Required

Restrict access to the i-Educar /intranet/ path to trusted networks or via VPN until a fix is available.
Instruct users, particularly administrators and teachers, to avoid clicking external links that point to their i-Educar instance.
Deploy WAF signatures that block reflected XSS patterns on the cod_curso parameter.
Rotate session cookies and enforce short session lifetimes to limit token reuse windows.

Patch Information

As of the last NVD update on 2026-06-17, no vendor advisory or official patch has been published by Portabilis. The vendor did not respond to disclosure attempts. Administrators should monitor the Portabilis i-Educar GitHub repository for future releases addressing the Course Module input handling. Until an upstream fix is issued, apply compensating controls at the web server and WAF layer.

Workarounds

Configure the web server (Apache or Nginx) to reject requests to educar_curso_det.php where cod_curso is non-numeric, since the parameter is a course identifier.
Add an HTTP Content-Security-Policy header that disallows inline scripts to limit reflected XSS impact.
Set the HttpOnly and Secure flags on session cookies to reduce theft via JavaScript.
Apply a reverse-proxy filter that HTML-encodes reflected query parameters before responses are returned to browsers.

bash

# Nginx workaround: enforce numeric cod_curso and add CSP header
location = /intranet/educar_curso_det.php {
    if ($arg_cod_curso !~ ^[0-9]+$) {
        return 400;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;
    add_header X-XSS-Protection "1; mode=block" always;
    proxy_pass http://ieducar_backend;
}