CVE-2025-8510: Portabilis i-Educar XSS Vulnerability

CVE-2025-8510 Overview

CVE-2025-8510 is a reflected cross-site scripting (XSS) vulnerability in Portabilis i-Educar 2.10.0. The flaw resides in the Gerar function of ieducar/intranet/educar_matricula_lst.php. An authenticated attacker can manipulate the ref_cod_aluno GET parameter to inject script content that executes in the victim's browser.

The vulnerability is remotely exploitable and the exploit details have been publicly disclosed. The vendor initially closed the original advisory without requesting a CVE. A patch is available in commit 82c288b9a4abb084bdfa1c0c4ef777ed45f98b46.

Critical Impact
Successful exploitation enables script execution in the context of an authenticated i-Educar user, allowing session abuse, UI redressing, and data theft from the school management interface.

Affected Products

Portabilis i-Educar 2.10.0
File: ieducar/intranet/educar_matricula_lst.php
Function: Gerar (parameter ref_cod_aluno)

Discovery Timeline

2025-08-03 - CVE-2025-8510 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8510

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw [CWE-79] in the student enrollment listing page of i-Educar. The Gerar function iterates over every entry in the $_GET superglobal and assigns the raw value directly to a corresponding object attribute. Because the ref_cod_aluno parameter is reflected back into the rendered HTML without sanitization or encoding, an attacker can inject arbitrary JavaScript.

Exploitation requires an authenticated user to visit a crafted URL. The payload then executes within the victim's authenticated session scope. Attack complexity is low and no special privileges are needed beyond standard application access, though user interaction is required.

Root Cause

The root cause is the pattern of blindly copying $_GET values to class properties and then emitting them into the page. The code performed no type coercion, no allow-listing of expected parameters, and no HTML output encoding. The patch replaces the loop with explicit, type-cast parameter retrieval using request()->integer(), which rejects non-numeric values before they reach the template.

Attack Vector

An attacker crafts a URL to educar_matricula_lst.php containing a malicious payload in ref_cod_aluno and delivers it to an authenticated i-Educar user through phishing, chat, or a third-party web page. When the user loads the URL, the injected script runs in the context of the i-Educar origin, giving the attacker access to session cookies, DOM content, and the ability to perform actions as the victim.

php

// Security patch applied in commit 82c288b9a4abb084bdfa1c0c4ef777ed45f98b46
// Ajusta coleta de parâmetros para evitar XSS
     {
         $this->titulo = 'Matrícula - Listagem';
 
-        foreach ($_GET as $var => $val) { // passa todos os valores obtidos no GET para atributos do objeto
-            $this->$var = ($val === '') ? null : $val;
-        }
+        $this->ref_cod_aluno = request()->integer('ref_cod_aluno');
+        $this->ref_cod_escola = request()->integer('ref_cod_escola');
 
         if (!$this->ref_cod_aluno) {
             $this->simpleRedirect(url: 'educar_aluno_lst.php');

Source: Portabilis i-Educar patch commit

Detection Methods for CVE-2025-8510

Indicators of Compromise

HTTP GET requests to educar_matricula_lst.php where ref_cod_aluno contains non-numeric characters, HTML tags, or URL-encoded script markers such as %3Cscript%3E.
Web server access logs showing abnormally long ref_cod_aluno values or payloads containing onerror=, onload=, javascript:, or document.cookie.
Referrer headers pointing to external domains for requests that reach administrative i-Educar pages.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query parameters for reflected XSS payloads targeting educar_matricula_lst.php.
Enable server-side request logging with full query string capture, then alert on non-integer values for ref_cod_aluno and ref_cod_escola.
Review browser-side Content Security Policy (CSP) violation reports for inline script execution on i-Educar hosts.

Monitoring Recommendations

Correlate authenticated i-Educar sessions with outbound requests to unknown domains that could indicate cookie exfiltration.
Monitor for repeated access attempts to the enrollment listing page from a single source using varied ref_cod_aluno values.
Track administrator and teacher accounts for unexpected session activity following the receipt of external links.

How to Mitigate CVE-2025-8510

Immediate Actions Required

Apply the upstream patch from commit 82c288b9a4abb084bdfa1c0c4ef777ed45f98b46 to all i-Educar 2.10.0 deployments.
Restrict access to the i-Educar web interface to trusted networks or VPN until the patch is deployed.
Invalidate active user sessions after patching and require re-authentication to flush any compromised session cookies.

Patch Information

The fix is published in the official Portabilis repository as commit 82c288b9a4abb084bdfa1c0c4ef777ed45f98b46. It replaces the loop that mapped arbitrary $_GET values onto object properties with explicit integer parameter retrieval via request()->integer(). See the Portabilis i-Educar GitHub security comparison and the reflected XSS vulnerability report.

Workarounds

Deploy WAF signatures that block requests to educar_matricula_lst.php when ref_cod_aluno is not a positive integer.
Add a reverse-proxy rule to strip or reject query parameters containing <, >, ", or ' characters before they reach the application.
Enforce a strict Content Security Policy that disables inline scripts to reduce the impact of reflected payloads.

bash

# Example nginx rule to reject non-numeric ref_cod_aluno values
location /intranet/educar_matricula_lst.php {
    if ($arg_ref_cod_aluno !~ "^[0-9]*$") {
        return 400;
    }
    proxy_pass http://ieducar_backend;
}