CVE-2025-8509: Portabilis i-Educar XSS Vulnerability

CVE-2025-8509 Overview

CVE-2025-8509 is a stored cross-site scripting (XSS) vulnerability in Portabilis i-Educar 2.9, an open-source school management platform. The flaw resides in /intranet/educar_servidor_cad.php, where the matricula parameter is reflected without proper sanitization. An authenticated attacker can inject arbitrary JavaScript that executes in the browser of any user who later views the affected record. The exploit has been publicly disclosed, and the vendor did not respond to pre-disclosure outreach. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated users can inject persistent JavaScript into the i-Educar interface, enabling session theft, administrative action hijacking, and credential harvesting against school staff accounts.

Affected Products

Portabilis i-Educar 2.9.0
educar_servidor_cad.php module within the intranet component
Deployments exposing the server registration workflow to low-privileged users

Discovery Timeline

2025-08-03 - CVE-2025-8509 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8509

Vulnerability Analysis

The vulnerability affects the server registration page /intranet/educar_servidor_cad.php in Portabilis i-Educar 2.9. The matricula HTTP parameter is accepted from the user, stored by the application, and later rendered into HTML output without encoding. Because the payload is stored, every subsequent view of the affected record triggers execution of attacker-controlled JavaScript in the victim's browser session.

Exploitation requires low privileges and some user interaction, since a legitimate user must open the page displaying the injected value. Once triggered, the script runs in the context of the i-Educar application origin, exposing session cookies, CSRF tokens, and any data accessible through the authenticated UI.

Root Cause

The root cause is missing output encoding and insufficient input validation on the matricula parameter in educar_servidor_cad.php. The application neither filters HTML control characters on input nor applies context-appropriate escaping when the value is rendered into the response page.

Attack Vector

The attack is network-based and requires an authenticated session with the ability to submit the server registration form. An attacker supplies an HTML or JavaScript payload in the matricula field. When a staff member or administrator later browses the record, the payload executes in their browser, inheriting their session privileges within i-Educar.

No verified exploit code is reproduced here. Technical write-ups and proof-of-concept details are published in the GitHub PoC Repository for CVE-2025-8509 and the Stored XSS Writeup for the matricula Parameter.

Detection Methods for CVE-2025-8509

Indicators of Compromise

HTTP POST requests to /intranet/educar_servidor_cad.php containing <script>, onerror=, onload=, or javascript: sequences in the matricula parameter
Database rows in the server registration tables containing HTML tags or encoded script fragments
Unexpected outbound requests from staff browsers to attacker-controlled domains shortly after loading i-Educar pages

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the matricula parameter for HTML and script metacharacters before requests reach the application
Perform periodic database integrity scans across i-Educar tables looking for stored HTML or JavaScript in text fields that should contain alphanumeric identifiers
Correlate authenticated session activity with anomalous JavaScript execution patterns in browser telemetry

Monitoring Recommendations

Enable verbose request logging on the i-Educar web tier and retain POST bodies for the registration endpoints
Monitor browser Content Security Policy (CSP) violation reports from staff workstations accessing i-Educar
Alert on sudden spikes in session cookie exfiltration patterns or outbound beacons originating from the i-Educar origin

How to Mitigate CVE-2025-8509

Immediate Actions Required

Restrict access to /intranet/educar_servidor_cad.php to a minimal set of trusted administrators until a vendor fix is available
Audit the server registration tables for pre-existing script payloads in the matricula field and sanitize or remove suspicious entries
Deploy a strict Content Security Policy to block inline script execution in the i-Educar interface

Patch Information

No vendor patch is referenced in the published advisory. The reporter notes that Portabilis did not respond to disclosure outreach. Organizations should monitor the Portabilis i-Educar GitHub repository for updates and track the VulDB entry #318608 for remediation status.

Workarounds

Place i-Educar behind a WAF configured to reject HTML and JavaScript metacharacters in form parameters that should hold identifiers
Apply input validation at a reverse proxy layer to allowlist expected character classes for the matricula parameter
Enforce the HttpOnly and SameSite=Strict attributes on session cookies to limit the impact of successful script execution

bash

# Example NGINX reverse proxy rule to block script-like payloads in the matricula parameter
location /intranet/educar_servidor_cad.php {
    if ($arg_matricula ~* "(<|%3C)\s*script|javascript:|onerror=|onload=") {
        return 403;
    }
    proxy_pass http://ieducar_backend;
}