CVE-2024-45057

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the dynamic generation of HTML fields prior to the 2.9 branch. The file located at `ieducar/intranet/include/clsCampos.inc.php` does not properly validate or sanitize user-controlled input, leading to the vulnerability. Any page that uses this implementation is vulnerable, such as `intranet/educar_curso_lst.php?nm_curso=<payload>`, `intranet/atendidos_lst.php?nm_pessoa=<payload>`, `intranet/educar_abandono_tipo_lst?nome=<payload>`. Commit f2d768534aabc09b2a1fc8a5cc5f9c93925cb273 contains a patch for the issue.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/portabilis/i-educar/commit/f2d768534aabc09b2a1fc8a5cc5f9c93925cb273	Patch
https://github.com/portabilis/i-educar/security/advisories/GHSA-fqwh-c3c8-7gwj	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:portabilis:i-educar:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-08-28 21:15

Updated : 2024-09-13 20:03

NVD link : CVE-2024-45057

Mitre link : CVE-2024-45057

CVE.ORG link : CVE-2024-45057

JSON object : View

Products Affected

portabilis

i-educar

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-45057", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-08-28T21:15:07.027", "references": [{"url": "https://github.com/portabilis/i-educar/commit/f2d768534aabc09b2a1fc8a5cc5f9c93925cb273", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/portabilis/i-educar/security/advisories/GHSA-fqwh-c3c8-7gwj", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the dynamic generation of HTML fields prior to the 2.9 branch. The file located at `ieducar/intranet/include/clsCampos.inc.php` does not properly validate or sanitize user-controlled input, leading to the vulnerability. Any page that uses this implementation is vulnerable, such as `intranet/educar_curso_lst.php?nm_curso=<payload>`, `intranet/atendidos_lst.php?nm_pessoa=<payload>`, `intranet/educar_abandono_tipo_lst?nome=<payload>`. Commit f2d768534aabc09b2a1fc8a5cc5f9c93925cb273 contains a patch for the issue."}, {"lang": "es", "value": "i-Educar es un software de gesti\u00f3n escolar totalmente online y gratuito que permite a las secretarias, profesores, coordinadores y responsables de \u00e1rea de la escuela gestionar de forma din\u00e1mica los valores de los campos HTML. La falta de desinfecci\u00f3n de los par\u00e1metros controlados por el usuario para generar din\u00e1micamente los valores de los campos HTML conduce a ataques XSS (Cross-Site Scripting). La generaci\u00f3n din\u00e1mica de los campos HTML en el archivo ieducar/intranet/include/clsCampos.inc.php no realiza la validaci\u00f3n o desinfecci\u00f3n correcta, reflejando los valores controlados por el usuario que se mostrar\u00e1n en el HTML de la p\u00e1gina. Esto permite a un atacante inyectar un payload XSS espec\u00edfico en un par\u00e1metro. La explotaci\u00f3n exitosa de esta falla permite a un atacante enga\u00f1ar a la v\u00edctima para que haga clic en una URL vulnerable, lo que permite que se ejecuten scripts de JavaScript en el navegador. Debido a la configuraci\u00f3n de las cookies de sesi\u00f3n, con los flags HttpOnly y SameSite=Lax definidos, es poco lo que un atacante puede hacer para robar la sesi\u00f3n o forzar a la v\u00edctima a realizar acciones dentro de la aplicaci\u00f3n. Este problema ha sido parcheado pero a\u00fan no se ha realizado una nueva versi\u00f3n. Se recomienda a los usuarios que se pongan en contacto con el desarrollador y coordinen un cronograma de actualizaci\u00f3n."}], "lastModified": "2024-09-13T20:03:10.947", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:portabilis:i-educar:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BAA7BA67-9C1B-461B-90CF-2BB79C838BAF", "versionEndIncluding": "2.9"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}