| शीर्षक | Portabilis i-Educar 2.9.0 Stored Cross Site Scripting |
|---|
| विवरण | Hello team!
A Stored XSS vulnerability was identified in the i-Educar system through the "Benefício" field in the student benefits registration feature. The application does not sanitize input properly, allowing malicious JavaScript to be stored and executed each time the benefits listing page is accessed. Authenticated users (e.g., administrators or school staff) are at risk when viewing the injected data.
1 - Authentication:
Log into the i-Educar platform with valid credentials.
2 - Access the Module:
Navigate to:
Cadastro > Tipo > Aluno > Tipo de benefício
3 - Create New Benefit Entry:
Click on the "Novo" button at:
/intranet/educar_aluno_beneficio_lst.php
4 - Insert Payload:
In the “Benefício” field at
/intranet/educar_aluno_beneficio_cad.php,
insert the following payload:
<script>alert('PoC VulDB PacXXX')</script>
5 - Automatic Execution:
Every time the listing page (educar_aluno_beneficio_lst.php) is loaded, the injected JavaScript will execute automatically.
Recommendations & Mitigations
Input Sanitization: Strip HTML/script tags and escape special characters in all input fields.
HTML Encoding: Ensure all dynamic content is safely encoded when rendered on the page.
Use of XSS Protection Libraries: Leverage libraries like OWASP Java Encoder or DOMPurify to filter untrusted data.
|
|---|
| स्रोत | ⚠️ https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README11.md |
|---|
| उपयोगकर्ता | RaulPACXXX (UID 84502) |
|---|
| सबमिशन | 27/06/2025 12:27 AM (1 वर्ष पहले) |
|---|
| संयम | 06/07/2025 07:41 AM (9 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 315020 [Portabilis i-Educar 2.9.0 Student Benefits Registration educar_aluno_beneficio_lst.php Benefício क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|