CVE-2023-5578 in i-Educar
Summary
by MITRE • 10/25/2023
A vulnerability was detected in Portábilis i-Educar up to 2.7.5. Affected is an unknown function of the file \intranet\agenda_imprimir.php of the component HTTP GET Request Handler. The manipulation of the argument cod_agenda with the input ");'> <script>alert(document.cookie)</script> results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Upgrading the affected component is recommended. The vendor explains: "This endpoint and the associated functionality are no longer present in the current i-Educar codebase, as the affected area was removed from the product. As a result, the previously reported attack vector (...) is no longer applicable to versions in which this functionality has been removed."
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified as CVE-2023-5578 represents a critical cross-site scripting flaw discovered in the Portábilis i-Educar platform version 2.7.5 and earlier. This security weakness resides within the HTTP GET request handler component, specifically affecting the \intranetgenda_imprimir.php file which processes user input through the cod_agenda parameter. The vulnerability stems from insufficient input validation and output encoding mechanisms that fail to properly sanitize user-supplied data before incorporating it into web responses. The flaw manifests when an attacker manipulates the cod_agenda argument with malicious payload containing the sequence ");'> alert(document.cookie), which when executed in a victim's browser context can retrieve and potentially expose sensitive session cookies. This type of vulnerability falls under CWE-79 - Improper Neutralization of Input During Web Page Generation, which is a fundamental web application security weakness that allows attackers to inject malicious scripts into web pages viewed by other users.
The operational impact of this vulnerability extends beyond simple script execution as it enables attackers to perform session hijacking, steal user credentials, and potentially escalate privileges within the application environment. The remote exploit capability means that attackers can launch attacks without requiring physical access to the target system, making the vulnerability particularly dangerous for educational institutions that rely on web-based platforms for administrative and academic operations. The fact that this exploit has been publicly disclosed and is actively being used increases the risk profile significantly, as it removes the element of surprise that typically protects systems from zero-day attacks. According to ATT&CK framework, this vulnerability maps to T1059.007 - Command and Scripting Interpreter: JavaScript, where attackers leverage client-side scripting to execute malicious code in victim browsers.
The security implications of this flaw are particularly severe for educational environments where sensitive student data, academic records, and administrative information are processed through the i-Educar platform. The lack of vendor response to early disclosure attempts compounds the risk, leaving organizations without official patches or mitigation guidance during an active exploitation period. Organizations should immediately implement defensive measures including input validation, output encoding, and web application firewall rules to block malicious payloads targeting the cod_agenda parameter. The vulnerability demonstrates the critical importance of proper input sanitization and the need for comprehensive security testing in web applications, particularly those handling sensitive educational data. Security teams should also conduct thorough audits of similar components within the application to identify potential additional cross-site scripting vulnerabilities that may exist in other parameter handlers or file processing functions.