Portabilis i-Diario Cross-Site Scripting Vulnerability in Informações Adicionais Page

A stored cross-site scripting vulnerability has been identified in Portabilis i-Diario versions through 1.5.0. The issue resides in the Informações Adicionais Page, specifically within the '/planos-de-ensino-por-disciplina/[ID]' endpoint. The vulnerability allows for the injection of malicious scripts into multiple parameters, including 'Parecer', 'Conteúdos', and 'Objetivos'. These injected scripts are stored on the server and executed automatically when the affected page is accessed by users, posing a significant security risk.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user accessing the page. This can lead to session hijacking, downloading of malware, browser hijacking, credential theft, exposure of sensitive information, website defacement, misdirection of users, and damage to a business's reputation.

Reproduction

To reproduce this vulnerability, send a POST request to the '/planos-de-ensino-por-disciplina/[ID]' endpoint. Include a script payload in the 'Parecer' parameter. After saving the input, access the 'Histórico' option to trigger the execution of the injected script.