CVE-2025-8365: Portabilis i-Educar XSS Vulnerability

CVE-2025-8365 Overview

CVE-2025-8365 is a stored cross-site scripting (XSS) vulnerability in Portabilis i-Educar 2.10, an open-source school management platform. The flaw resides in the atendidos_cad.php script, where the nome, nome_social, and email parameters are rendered without proper output encoding. An authenticated attacker can inject persistent JavaScript payloads that execute in the browser of any user viewing the affected record. The exploit details have been disclosed publicly, and the vendor did not respond to disclosure attempts.

Critical Impact
Persistent script execution in the context of authenticated i-Educar users can enable session theft, unauthorized administrative actions, and data exposure across the school management system.

Affected Products

Portabilis i-Educar 2.10.0
Component: atendidos_cad.php
Vulnerable parameters: nome, nome_social, email

Discovery Timeline

2025-07-31 - CVE-2025-8365 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8365

Vulnerability Analysis

The vulnerability is a stored cross-site scripting issue [CWE-79] in the attendee registration workflow of i-Educar. The atendidos_cad.php endpoint accepts user-controlled input through the nome (name), nome_social (social name), and email fields. These values are persisted to the database and later rendered in HTML pages without adequate sanitization or contextual encoding.

When another authenticated user, such as a staff member or administrator, opens a record that contains an attacker-supplied payload, the injected JavaScript executes in the victim's browser session. Exploitation requires low privileges and some form of user interaction to trigger the stored payload. The confidentiality and availability impact on the vulnerable component is minimal, but the integrity impact allows arbitrary DOM manipulation within the application context.

Root Cause

The root cause is missing output encoding on data that originates from untrusted user input. The application stores the nome, nome_social, and email values verbatim and reflects them into HTML contexts without applying HTML entity encoding or a strict content-security policy.

Attack Vector

An authenticated attacker submits a crafted attendee record through atendidos_cad.php, embedding a JavaScript payload in one of the vulnerable parameters. The payload persists in the database. When any user later views the record, the script executes in that user's browser, allowing session token theft, forced navigation, credential capture through injected forms, or automated actions performed as the victim. Technical proof-of-concept details are available in the GitHub PoC Repository and the VulDB CVE Analysis.

Detection Methods for CVE-2025-8365

Indicators of Compromise

Attendee records in the i-Educar database containing HTML or JavaScript syntax in the nome, nome_social, or email fields (for example <script>, onerror=, javascript:).
Unusual outbound requests from staff browsers to attacker-controlled hosts shortly after opening an attendee record.
Web server access logs showing POST requests to atendidos_cad.php with encoded angle brackets or event handler strings.

Detection Strategies

Query the i-Educar database for stored values matching XSS signatures across the three affected columns.
Deploy a web application firewall rule that inspects submissions to atendidos_cad.php for script tags, event handlers, and JavaScript URIs.
Enable Content Security Policy (CSP) reporting to capture blocked inline script execution attempts on attendee pages.

Monitoring Recommendations

Monitor authenticated session activity for anomalous administrative actions occurring immediately after an attendee page render.
Alert on staff endpoints initiating cross-origin requests to non-institutional domains from the i-Educar portal.
Review audit logs for record creation and edits from low-privilege accounts targeting the vulnerable fields.

How to Mitigate CVE-2025-8365

Immediate Actions Required

Restrict access to atendidos_cad.php to trusted networks or authenticated staff roles until a patch is available.
Sanitize existing database records by stripping HTML from the nome, nome_social, and email fields.
Enforce a restrictive Content Security Policy that disallows inline scripts across i-Educar application pages.

Patch Information

As of the last NVD update on 2026-06-17, Portabilis has not published a vendor advisory or patch for CVE-2025-8365. The vendor did not respond to the coordinated disclosure. Monitor the VulDB entry #318337 and the official Portabilis i-Educar project channels for future fixes. Organizations maintaining local forks should apply HTML entity encoding on all output of the affected parameters and validate input against a strict allowlist.

Workarounds

Place i-Educar behind a web application firewall with signatures for stored XSS payloads targeting the identified parameters.
Apply server-side input filtering on atendidos_cad.php to reject requests containing <, >, or JavaScript event handler patterns in the affected fields.
Require re-authentication for sensitive administrative workflows to limit the impact of hijacked sessions.

bash

# Example ModSecurity rule to block script payloads on the vulnerable endpoint
SecRule REQUEST_URI "@contains /atendidos_cad.php" \
  "phase:2,chain,deny,status:403,id:1008365,\
   msg:'Potential stored XSS attempt against i-Educar (CVE-2025-8365)'"
  SecRule ARGS:nome|ARGS:nome_social|ARGS:email \
    "@rx (?i)(<script|onerror\s*=|javascript:|<img[^>]+src)"