Portabilis i-Educar Broken Access Control Vulnerability in Exportacao-para-o-seb Endpoint

A broken access control vulnerability has been identified in the Portabilis i-Educar application, affecting versions through 2.10. The vulnerability resides in the '/exportacao-para-o-seb' endpoint, where improper access controls allow low-privileged users to access restricted functionality. This issue can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows unauthorized access to functionality intended for higher-privileged users, potentially leading to unauthorized data access or manipulation.

Reproduction

To reproduce this vulnerability, authenticate as a low-privileged user and send a POST request to the '/exportacao-para-o-seb' endpoint. Include the necessary cookies and headers to mimic a legitimate user session. The response will contain a file that should not be accessible to the user.