| Titre | Portabilis i-Educar 2.9 Cross Site Scripting |
|---|
| Description | # Cross-Site Scripting (XSS) Reflected endpoint `/intranet/educar_avaliacao_desempenho_lst.php` parameter `titulo_avaliacao`
---
## Summary
A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `/intranet/educar_avaliacao_desempenho_lst.php` endpoint of the _i-educar_ application. This vulnerability allows attackers to inject malicious scripts into the `titulo_avaliacao` parameter.
---
## Details
**Vulnerable Endpoint:** `GET /intranet/educar_avaliacao_desempenho_lst.php`
**Parameter:** `titulo_avaliacao`
The application fails to validate and sanitize user input in the `titulo_avaliacao` parameter. This lack of input validation permits the injection of a malicious script payload, which is reflected in the HTTP response and executed in the victim’s browser context.
---
## PoC
**Encoded Payload:**
`%22%3E%3Cscript%3Ealert%28%27XSS-PoC%27%29%3C%2Fscript%3E`
**Decoded Payload:**
`"><script>alert('XSS-PoC')</script>`
<img width="724" height="774" alt="image" src="https://github.com/user-attachments/assets/bbe2cbf0-aef2-4961-9ced-38b41ca6169f" />
**URL:**
`/intranet/educar_avaliacao_desempenho_lst.php?titulo_avaliacao=%22%3E%3Cscript%3Ealert%28%27XSS-PoC%27%29%3C%2Fscript%3E`
When a user accesses this crafted URL, the script is executed immediately in the browser, confirming the vulnerability.
---
## Impact
Reflected cross-site scripting (XSS) attacks can have serious consequences, including:
- **User actions:** Attackers can perform any action the user can, such as viewing, modifying, or initiating interactions with other users
- **Data theft:** Attackers can exfiltrate data or install malware on the user's machine
- **Account compromise:** Attackers can manipulate or steal cookies, or compromise confidential information
- **Malicious code:** Attackers can execute malicious code on the user's system
- **Business reputation damage:** Attackers can deface a corporate website or spread misinformation
- **Misdirection:** Attackers can change the instructions given to users, which can be dangerous if the target is a government website or provides vital resources
## Discoverer
[Marcelo Queiroz](www.linkedin.com/in/marceloqueirozjr)
by [CVE-Hunters](https://github.com/Sec-Dojo-Cyber-House/cve-hunters) |
|---|
| La source | ⚠️ https://github.com/marcelomulder/CVE/blob/main/i-educar/Reflected%20XXS%20educar_avaliacao_desempenho_lst.md |
|---|
| Utilisateur | marceloQz (UID 87549) |
|---|
| Soumission | 18/07/2025 22:18 (il y a 9 mois) |
|---|
| Modérer | 30/07/2025 18:37 (12 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 318341 [Portabilis i-Educar 2.9 educar_avaliacao_desempenho_lst.php titulo_avaliacao cross site scripting] |
|---|
| Points | 20 |
|---|