Portabilis i-Educar Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Portabilis i-Educar version 2.9. The issue resides in the '/intranet/educar_avaliacao_desempenho_cad.php' endpoint, where the 'titulo_avaliacao' and 'descricao' parameters can be manipulated to inject malicious scripts. These scripts are stored on the server and executed in the context of the user's browser when the affected page is accessed, posing a significant security risk.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the content. This can lead to session hijacking, credential theft, delivery of malware, and other severe consequences associated with cross-site scripting attacks.

Reproduction

To reproduce this vulnerability, send a POST request to '/intranet/educar_avaliacao_desempenho_cad.php' with the 'titulo_avaliacao' and 'descricao' parameters containing the injected script payload. Once the payload is submitted, it will be executed automatically when the page is accessed by users.