CVE-2025-8785: Portabilis i-Educar XSS Vulnerability

CVE-2025-8785 Overview

CVE-2025-8785 is a reflected cross-site scripting (XSS) vulnerability in Portabilis i-Educar through version 2.9. The flaw resides in /intranet/educar_usuario_lst.php, where the nm_pessoa, matricula, and matricula_interna request parameters are reflected into the response without proper output encoding. Authenticated attackers can craft a malicious URL that executes JavaScript in a victim's browser session. The vulnerability is classified under CWE-79 and has been publicly disclosed. According to the disclosure, the vendor was contacted but did not respond.

Critical Impact
Attackers can execute arbitrary JavaScript in the browser of an authenticated i-Educar user, enabling session abuse, phishing, and defacement within the school management portal.

Affected Products

Portabilis i-Educar versions up to and including 2.9
The vulnerable endpoint: /intranet/educar_usuario_lst.php
Deployments exposing the i-Educar intranet interface to authenticated users

Discovery Timeline

2025-08-10 - CVE-2025-8785 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8785

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the user listing endpoint of the i-Educar school management platform. The script educar_usuario_lst.php accepts search parameters nm_pessoa, matricula, and matricula_interna from user input. These values are echoed back into the rendered HTML page without sufficient sanitization or context-aware output encoding.

An attacker who convinces an authenticated user to load a crafted URL triggers execution of injected JavaScript in the victim's browser. Because the payload runs in the origin of the i-Educar application, it inherits access to the user's authenticated session, cookies not protected by HttpOnly, and any DOM data visible to the page. The exploit has been publicly disclosed, increasing the likelihood of opportunistic use.

Root Cause

The root cause is missing output encoding of user-controlled query parameters in the search form results. The application does not apply HTML entity encoding to nm_pessoa, matricula, or matricula_interna before including them in the response. This maps directly to CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires network access to the i-Educar instance and valid low-privilege credentials to reach the intranet endpoint. The attacker delivers a crafted link containing a payload in one of the three parameters. When the victim visits the URL, the injected script executes in the victim's browser context. Further technical detail is available in the GitHub reflected XSS analysis by marcelomulder and the VulDB entry #319313.

Detection Methods for CVE-2025-8785

Indicators of Compromise

Web server access logs containing requests to /intranet/educar_usuario_lst.php with nm_pessoa, matricula, or matricula_interna values that include HTML tags, <script> fragments, javascript: URIs, or event handlers such as onerror= and onload=.
URL-encoded payloads such as %3Cscript%3E, %3Cimg, or %22%3E appearing in the same query parameters.
Outbound requests from user browsers to attacker-controlled domains shortly after visits to the vulnerable endpoint.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query strings on educar_usuario_lst.php for XSS payload signatures and reject or log matches.
Correlate referer headers and request patterns to identify users arriving from external links directly into the vulnerable endpoint with parameter payloads.
Review historical access logs for the three named parameters to identify past exploitation attempts.

Monitoring Recommendations

Enable and centralize HTTP access logging for the i-Educar application, including full query strings, in a SIEM.
Alert on Content Security Policy (CSP) violation reports if CSP is enabled in report-only or enforcing mode.
Monitor authenticated user sessions for anomalous activity following visits to the vulnerable endpoint, including unexpected privilege changes or data exports.

How to Mitigate CVE-2025-8785

Immediate Actions Required

Restrict access to /intranet/educar_usuario_lst.php behind VPN or trusted network segments until a fix is available.
Deploy WAF rules that block requests to the endpoint containing HTML metacharacters in nm_pessoa, matricula, and matricula_interna.
Rotate session cookies and require re-authentication for users who may have visited untrusted links referencing the endpoint.

Patch Information

No vendor patch has been published for CVE-2025-8785 as of the last NVD update. The disclosure notes the vendor did not respond. Organizations should monitor the Portabilis i-Educar GitHub repository for future fixes and consider maintaining an internal patch that applies HTML entity encoding to reflected parameters in educar_usuario_lst.php.

Workarounds

Apply a local source-code fix that wraps the three parameters with an HTML-encoding function such as htmlspecialchars($value, ENT_QUOTES, 'UTF-8') before rendering.
Enforce a strict Content Security Policy that disallows inline script execution to blunt reflected XSS payloads.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of successful script execution.
Limit access to the intranet interface to authenticated staff on trusted networks only.

bash

# Example Apache mod_security rule to block XSS payloads on the vulnerable endpoint
SecRule REQUEST_URI "@contains /intranet/educar_usuario_lst.php" \
  "id:1008785,phase:2,deny,status:403,log,msg:'CVE-2025-8785 XSS attempt',\
  chain"
  SecRule ARGS:nm_pessoa|ARGS:matricula|ARGS:matricula_interna \
    "@rx (?i)(<script|javascript:|on[a-z]+\s*=)"