Executive Summary

CVE-2025-9720 is a stored Cross-Site Scripting (XSS) vulnerability in Portabilis i-Educar up to version 2.10. It occurs in the /module/TabelaArredondamento/edit endpoint, specifically in the 'Nome' parameter, where improper input validation allows attackers to inject malicious scripts. These scripts are stored on the server and executed automatically when users access the affected page, potentially leading to unauthorized script execution in users' browsers. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to session cookie theft, browser hijacking, credential theft, malware delivery, unauthorized access to sensitive information, website defacement, user misdirection, and reputational damage to the affected organization. Attackers can remotely exploit this flaw to execute malicious scripts in users' browsers, compromising data integrity and security. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the /module/TabelaArredondamento/edit endpoint for improper input sanitization of the 'Nome' parameter. A common detection method is to submit a payload such as `"><img src=x onerror=alert('CVE-Hunters')>` into the 'Nome' field and then check if the script executes on the subsequent page load (/module/TabelaArredondamento/index). Network detection might involve monitoring HTTP requests to this endpoint for suspicious payloads or scanning web application inputs for XSS vulnerabilities using tools like OWASP ZAP or Burp Suite. Specific commands depend on the tools used, for example, using curl to POST the payload: `curl -X POST -d "Nome=\"><img src=x onerror=alert('CVE-Hunters')>" https://target/module/TabelaArredondamento/edit` and then accessing the page to observe if the script triggers. [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding use of the affected Portabilis i-Educar versions up to 2.10 or replacing the affected component. Since no known mitigations or countermeasures have been identified, it is recommended to restrict access to the vulnerable endpoint, implement web application firewall (WAF) rules to block malicious input patterns targeting the 'Nome' parameter, and sanitize or validate inputs on the server side if possible. Monitoring for exploitation attempts and applying strict input validation are critical until a patch or update is available. [2]

Useful 0 Not Useful 0