Portabilis i-Educar Cross-Site Scripting Vulnerability in User Types Management

A stored cross-site scripting vulnerability has been identified in Portabilis i-Educar version 2.10. The issue resides in the 'tipos/novo' endpoint, where user input in the 'name' and 'description' fields is not properly validated or sanitized. This allows attackers to inject malicious scripts that are stored on the server and executed in the context of users accessing the 'tipos' page. The vulnerability can be exploited remotely, but requires authentication and user interaction.

Impact

Exploitation of this vulnerability allows for multiple stored cross-site scripting impacts, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, log into the application and navigate to the 'tipos/novo' endpoint. Insert a payload, such as an image tag with an 'onerror' event, into the 'Tipo de Usuário' and 'Descrição' fields. After saving, the injected script will execute when the 'tipos' page is accessed.