Portabilis i-Educar Cross-Site Scripting Vulnerability in Transfer Type Management Page

A stored cross-site scripting vulnerability has been identified in Portabilis i-Educar versions through 2.10. The issue resides in the 'Cadastrar tipo de transferência' page, specifically within the '/intranet/educar_transferencia_tipo_cad.php' file. The vulnerability is triggered by manipulating the 'nm_tipo' and 'desc_tipo' parameters, allowing attackers to inject malicious scripts. These scripts are stored on the server and executed automatically when the page is accessed by users, posing a significant security risk.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user accessing the page. This could lead to session hijacking, credential theft, and other malicious actions as described in the vulnerability discovery source.

Reproduction

To reproduce this vulnerability, access the '/intranet/educar_transferencia_tipo_cad.php' endpoint. Select the default option in the first field, then insert a payload into the 'Motivo Transferência' and 'Descrição' fields. After saving, the trigger page '/intranet/educar_transferencia_tipo_lst.php' will be activated automatically, executing the injected script.