CVE-2025-8508: Portabilis i-Educar XSS Vulnerability

CVE-2025-8508 Overview

CVE-2025-8508 is a stored cross-site scripting (XSS) vulnerability in Portabilis i-Educar 2.9, an open-source school management platform. The flaw resides in /intranet/educar_avaliacao_desempenho_cad.php, where the titulo_avaliacao and descricao parameters accept unsanitized input. An authenticated attacker can inject persistent JavaScript payloads that execute in the browser of any user who views the affected performance evaluation record. The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts. The vulnerability maps to CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated users can inject persistent JavaScript into performance evaluation records, enabling session token theft, credential harvesting, and unauthorized administrative actions when other users view the crafted content.

Affected Products

Portabilis i-Educar 2.9.0
The educar_avaliacao_desempenho_cad.php performance evaluation module
Deployments exposing the /intranet/ administrative interface to authenticated users

Discovery Timeline

2025-08-03 - CVE-2025-8508 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8508

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the performance evaluation registration workflow of i-Educar 2.9. The application accepts user-supplied values for the titulo_avaliacao (evaluation title) and descricao (description) fields and writes them to the database without HTML encoding or context-aware sanitization. When these records are subsequently rendered in listing or detail views, the injected markup is returned verbatim to the browser and executed in the security context of the i-Educar origin.

Because the attack requires only low-privileged authenticated access and is network-reachable, any user with permission to create performance evaluations can weaponize the flaw. The payload persists across sessions and affects every user who loads the tampered record, including administrators.

Root Cause

The root cause is missing output encoding on user-controlled input written by educar_avaliacao_desempenho_cad.php. The PHP code path fails to apply an HTML-context escape (for example, htmlspecialchars with ENT_QUOTES) before emitting the stored values into HTML templates. There is also no allow-listed input validation on the affected parameters.

Attack Vector

An authenticated attacker submits the performance evaluation creation form with a JavaScript payload embedded in titulo_avaliacao or descricao. The server stores the raw payload. When a victim (typically a teacher, coordinator, or administrator) opens the evaluations screen, the browser parses the injected <script> or event-handler attribute and executes attacker-controlled code. Public exploitation notes are available in the GitHub advisory for CVE-2025-8508 and the Stored XSS proof-of-concept writeup.

No verified exploit code is reproduced here. Refer to the linked researcher writeups for payload details.

Detection Methods for CVE-2025-8508

Indicators of Compromise

HTTP POST requests to /intranet/educar_avaliacao_desempenho_cad.php containing <script>, onerror=, onload=, javascript:, or URL-encoded equivalents in the titulo_avaliacao or descricao parameters.
Database rows in the performance evaluation tables holding HTML tags or JavaScript event handlers inside title or description columns.
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after loading i-Educar evaluation pages.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST bodies targeting educar_avaliacao_desempenho_cad.php for common XSS syntax and block or alert on matches.
Run periodic database queries against evaluation title and description columns to flag rows containing <, >, or on\w+= patterns.
Enable verbose PHP access logging and correlate authenticated sessions that submit script-like payloads against subsequent anomalous authenticated activity.

Monitoring Recommendations

Forward i-Educar web server and application logs into a centralized analytics platform and alert on writes to the affected endpoint containing HTML control characters.
Monitor endpoints used by administrators for browser process anomalies, credential access attempts, and outbound connections to newly registered domains after visiting the i-Educar console.
Track user account creation and role changes following any suspected XSS trigger to detect privilege escalation chained through stolen session cookies.

How to Mitigate CVE-2025-8508

Immediate Actions Required

Restrict access to /intranet/educar_avaliacao_desempenho_cad.php to trusted administrative users until a vendor patch is available.
Audit existing performance evaluation records for stored HTML or JavaScript and remove any suspicious entries.
Rotate session identifiers and credentials for accounts that may have loaded a tampered evaluation record.

Patch Information

No official vendor patch has been published at the time of the NVD entry. The vendor was contacted but did not respond, according to the VulDB advisory (#318607). Track the Portabilis i-Educar project for upstream fixes and apply them once released.

Workarounds

Place i-Educar behind a WAF and enforce signatures that strip or block HTML tags and JavaScript event handlers in the titulo_avaliacao and descricao parameters.
Add a strict Content-Security-Policy response header that disallows inline scripts and restricts script sources to trusted origins to blunt payload execution.
Apply a local code fix that wraps output of the affected fields with htmlspecialchars($value, ENT_QUOTES | ENT_HTML5, 'UTF-8') before rendering, and validate inputs against an allow-list of permitted characters.

bash

# Example nginx Content-Security-Policy header for i-Educar
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;