Portabilis i-Educar Cross-Site Scripting Vulnerability in atendidos_cad.php

A stored cross-site scripting vulnerability has been identified in Portabilis i-Educar version 2.10. The issue resides in the atendidos_cad.php file, where the nome, nome_social, and email parameters can be manipulated to inject malicious scripts. This vulnerability can be exploited remotely and requires user interaction.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, insert a payload, such as an image tag with an onerror event, into the nome or nome_social fields on the atendidos_cad.php endpoint. After saving, the payload can be triggered by accessing the atendidos_det.php endpoint.