Portabilis i-Educar Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Portabilis i-Educar version 2.9. The issue arises in the '/intranet/educar_funcao_lst.php' file, where the 'nm_funcao' and 'abreviatura' parameters are not properly validated or sanitized. This oversight allows remote attackers to inject malicious scripts that are executed in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the user's browser, potentially leading to data theft, account compromise, or execution of malicious code.

Reproduction

To reproduce this vulnerability, send a request to the '/intranet/educar_funcao_lst.php' endpoint with injected scripts in the 'nm_funcao' or 'abreviatura' parameters. The injected script will be reflected in the response and executed in the browser.