CVE-2024-45057

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the dynamic generation of HTML fields prior to the 2.9 branch. The file located at `ieducar/intranet/include/clsCampos.inc.php` does not properly validate or sanitize user-controlled input, leading to the vulnerability. Any page that uses this implementation is vulnerable, such as `intranet/educar_curso_lst.php?nm_curso=<payload>`, `intranet/atendidos_lst.php?nm_pessoa=<payload>`, `intranet/educar_abandono_tipo_lst?nome=<payload>`. Commit f2d768534aabc09b2a1fc8a5cc5f9c93925cb273 contains a patch for the issue.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/portabilis/i-educar/commit/f2d768534aabc09b2a1fc8a5cc5f9c93925cb273	Patch
https://github.com/portabilis/i-educar/security/advisories/GHSA-fqwh-c3c8-7gwj	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:portabilis:i-educar:*:*:*:*:*:*:*:*

History

13 Sep 2024, 20:03

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~6.3~~	v2 : unknown v3 : 6.1
First Time		Portabilis i-educar Portabilis
References	~~() https://github.com/portabilis/i-educar/commit/f2d768534aabc09b2a1fc8a5cc5f9c93925cb273 -~~	() https://github.com/portabilis/i-educar/commit/f2d768534aabc09b2a1fc8a5cc5f9c93925cb273 - Patch
References	~~() https://github.com/portabilis/i-educar/security/advisories/GHSA-fqwh-c3c8-7gwj -~~	() https://github.com/portabilis/i-educar/security/advisories/GHSA-fqwh-c3c8-7gwj - Exploit, Vendor Advisory
CPE		cpe:2.3:a:portabilis:i-educar::::::::

06 Sep 2024, 20:15

Type	Values Removed	Values Added
Summary	(en) i-Educar is free, completely online school management software that allows school secretaries, teachers, coordinators and area managers. The lack of sanitization of user-controlled parameters for generating HTML field values ??dynamically leads to XSS (Cross-Site Scripting) attacks. The dynamic generation of HTML fields in the ieducar/intranet/include/clsCampos.inc.php file does not perform the correct validation or sanitization, reflecting the user-controlled values ??to be shown in the page's HTML. This allows an attacker to inject a specific XSS payload into a parameter. Successful exploitation of this flaw allows an attacker to trick the victim into clicking a vulnerable URL, enabling JavaScript scripts to be executed in the browser. Due to the configuration of session cookies, with the HttpOnly and SameSite=Lax flags being defined, there is little an attacker can do to steal the session or force the victim to perform actions within the application. This issue hast been patched but a new release has not yet been made. Users are advised to contact the developer and to coordinate an update schedule.	(en) i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the dynamic generation of HTML fields prior to the 2.9 branch. The file located at `ieducar/intranet/include/clsCampos.inc.php` does not properly validate or sanitize user-controlled input, leading to the vulnerability. Any page that uses this implementation is vulnerable, such as `intranet/educar_curso_lst.php?nm_curso=<payload>`, `intranet/atendidos_lst.php?nm_pessoa=<payload>`, `intranet/educar_abandono_tipo_lst?nome=<payload>`. Commit f2d768534aabc09b2a1fc8a5cc5f9c93925cb273 contains a patch for the issue.

29 Aug 2024, 13:25

Type	Values Removed	Values Added
Summary		(es) i-Educar es un software de gestión escolar totalmente online y gratuito que permite a las secretarias, profesores, coordinadores y responsables de área de la escuela gestionar de forma dinámica los valores de los campos HTML. La falta de desinfección de los parámetros controlados por el usuario para generar dinámicamente los valores de los campos HTML conduce a ataques XSS (Cross-Site Scripting). La generación dinámica de los campos HTML en el archivo ieducar/intranet/include/clsCampos.inc.php no realiza la validación o desinfección correcta, reflejando los valores controlados por el usuario que se mostrarán en el HTML de la página. Esto permite a un atacante inyectar un payload XSS específico en un parámetro. La explotación exitosa de esta falla permite a un atacante engañar a la víctima para que haga clic en una URL vulnerable, lo que permite que se ejecuten scripts de JavaScript en el navegador. Debido a la configuración de las cookies de sesión, con los flags HttpOnly y SameSite=Lax definidos, es poco lo que un atacante puede hacer para robar la sesión o forzar a la víctima a realizar acciones dentro de la aplicación. Este problema ha sido parcheado pero aún no se ha realizado una nueva versión. Se recomienda a los usuarios que se pongan en contacto con el desarrollador y coordinen un cronograma de actualización.
Summary	(en) i-Educar is free, completely online school management software that allows school secretaries, teachers, coordinators and area managers. The lack of sanitization of user-controlled parameters for generating HTML field values dynamically leads to XSS (Cross-Site Scripting) attacks. The dynamic generation of HTML fields in the ieducar/intranet/include/clsCampos.inc.php file does not perform the correct validation or sanitization, reflecting the user-controlled values to be shown in the page's HTML. This allows an attacker to inject a specific XSS payload into a parameter. Successful exploitation of this flaw allows an attacker to trick the victim into clicking a vulnerable URL, enabling JavaScript scripts to be executed in the browser. Due to the configuration of session cookies, with the HttpOnly and SameSite=Lax flags being defined, there is little an attacker can do to steal the session or force the victim to perform actions within the application. This issue hast been patched but a new release has not yet been made. Users are advised to contact the developer and to coordinate an update schedule.	(en) i-Educar is free, completely online school management software that allows school secretaries, teachers, coordinators and area managers. The lack of sanitization of user-controlled parameters for generating HTML field values ??dynamically leads to XSS (Cross-Site Scripting) attacks. The dynamic generation of HTML fields in the ieducar/intranet/include/clsCampos.inc.php file does not perform the correct validation or sanitization, reflecting the user-controlled values ??to be shown in the page's HTML. This allows an attacker to inject a specific XSS payload into a parameter. Successful exploitation of this flaw allows an attacker to trick the victim into clicking a vulnerable URL, enabling JavaScript scripts to be executed in the browser. Due to the configuration of session cookies, with the HttpOnly and SameSite=Lax flags being defined, there is little an attacker can do to steal the session or force the victim to perform actions within the application. This issue hast been patched but a new release has not yet been made. Users are advised to contact the developer and to coordinate an update schedule.

28 Aug 2024, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-28 21:15

Updated : 2024-09-13 20:03

NVD link : CVE-2024-45057

Mitre link : CVE-2024-45057

CVE.ORG link : CVE-2024-45057

JSON object : View

Products Affected

portabilis

i-educar

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

6.1 /10