CVE-2025-7112: Portabilis I-educar XSS Vulnerability

CVE-2025-7112 Overview

CVE-2025-7112 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Portabilis i-Educar 2.9.0. The flaw resides in the Function Management Module, specifically the /intranet/educar_funcao_det.php endpoint. Attackers can manipulate the Função parameter to inject arbitrary JavaScript that executes in the browser context of users viewing the affected page.

The exploit has been publicly disclosed and can be initiated remotely. The vendor was contacted prior to disclosure but did not respond. The vulnerability requires low-privilege authentication and user interaction, which limits its practical impact.

Critical Impact
Authenticated attackers can inject persistent JavaScript payloads into the Function Management interface, enabling session hijacking, credential theft, or unauthorized actions performed in the victim's browser context.

Affected Products

Portabilis i-Educar 2.9.0
cpe:2.3:a:portabilis:i-educar:2.9.0:*:*:*:*:*:*:*
Function Management Module (educar_funcao_det.php)

Discovery Timeline

2025-07-07 - CVE-2025-7112 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7112

Vulnerability Analysis

The vulnerability affects the Function Management Module of i-Educar, an open-source school management platform developed by Portabilis. The affected endpoint accepts two query parameters, cod_funcao and ref_cod_instituicao, and processes the Função (Function) field without proper output encoding.

When an attacker submits a crafted payload through the Função argument, the application stores and later renders the value in the HTML response without sanitization. Any user visiting the affected function detail page executes the injected script under the application's origin.

The issue is classified as Cross-Site Scripting (XSS) under CWE-79. Exploitation requires network access, low-level privileges, and user interaction to trigger the injected payload.

Root Cause

The root cause is missing input validation and output encoding in the PHP code handling the Função field. The application concatenates user-controlled input directly into rendered HTML, violating standard secure coding practices that require context-aware escaping of untrusted data before display.

Attack Vector

An authenticated attacker with access to the Function Management Module submits a malicious value in the Função field. The payload persists in the database and executes when any user, including administrators, views the function details page at /intranet/educar_funcao_det.php?cod_funcao=COD&ref_cod_instituicao=COD. Successful exploitation can lead to session cookie theft, unauthorized administrative actions, or delivery of secondary payloads.

A public proof-of-concept is documented in the GitHub PoC repository. Additional technical context is available in the VulDB entry #315023.

Detection Methods for CVE-2025-7112

Indicators of Compromise

HTTP requests to /intranet/educar_funcao_det.php containing HTML tags, JavaScript event handlers, or <script> elements in the Função parameter
Database records within the function management tables containing encoded or raw script payloads
Unexpected outbound requests originating from user browsers after loading function detail pages
Session anomalies such as concurrent logins from unusual geographies following administrator access to the module

Detection Strategies

Inspect web server access logs for POST or GET requests to educar_funcao_det.php containing characters such as <, >, ", or common XSS keywords like onerror, onload, or javascript:
Deploy Web Application Firewall (WAF) rules that flag script-like payloads submitted to i-Educar endpoints
Perform periodic database audits on function name fields to identify stored HTML or JavaScript content

Monitoring Recommendations

Enable verbose HTTP request logging on the i-Educar application server and forward logs to a centralized analytics platform
Alert on Content Security Policy (CSP) violation reports if CSP headers are configured
Monitor administrative account activity for unusual session behavior after visits to the Function Management Module

How to Mitigate CVE-2025-7112

Immediate Actions Required

Restrict access to the Function Management Module to trusted administrators only until a patch is available
Deploy WAF rules that filter or block script tags and event handler attributes in requests to educar_funcao_det.php
Audit existing function records for injected payloads and sanitize any stored content
Enforce short session timeouts and require re-authentication for privileged operations

Patch Information

No vendor patch has been published at the time of writing. According to the VulDB advisory, Portabilis was contacted regarding this disclosure but did not respond. Monitor the Portabilis i-Educar GitHub repository for future security releases and apply updates as soon as they become available.

Workarounds

Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Configure reverse proxy or WAF rules to strip or encode HTML metacharacters in requests targeting the affected endpoint
Limit privileges of accounts that can create or modify function records to reduce the attacker population
Educate administrators to avoid clicking untrusted links or opening suspicious function detail pages until remediation is in place

bash

# Example ModSecurity rule to block script payloads on the affected endpoint
SecRule REQUEST_URI "@contains /intranet/educar_funcao_det.php" \
    "phase:2,chain,deny,status:403,id:1007112,\
    msg:'Potential XSS payload targeting i-Educar CVE-2025-7112'"
    SecRule ARGS|ARGS_NAMES "@rx (?i)(<script|onerror=|onload=|javascript:)" \
        "t:none,t:urlDecodeUni"