CVE-2024-45057 - CVE House

Back to Database

Status published Medium CVE-2024-45057

Reflected Cross-Site Scripting in i-Educar

6.3 CVSS

Vulnerability Description

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the dynamic generation of HTML fields prior to the 2.9 branch. The file located at `ieducar/intranet/include/clsCampos.inc.php` does not properly validate or sanitize user-controlled input, leading to the vulnerability. Any page that uses this implementation is vulnerable, such as `intranet/educar_curso_lst.php?nm_curso=<payload>`, `intranet/atendidos_lst.php?nm_pessoa=<payload>`, `intranet/educar_abandono_tipo_lst?nome=<payload>`. Commit f2d768534aabc09b2a1fc8a5cc5f9c93925cb273 contains a patch for the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-45057

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from portabilis

View All →

i-Educar Authenticated Time-based SQL Injection in `agenda_admin_cad.php`

i-Educar Authenticated Time-based SQL Injection in `funcionario_vinculo_cad.php`

i-Educar Authenticated Time-based SQL Injection in `agenda.php`

i-Educar Stored Cross-Site Scripting vulnerability

Authenticated SQL Injection in i-Educar

Affected Vendor

portabilis

View all reports →

Affected Software

i-educar

Vulnerable Versions:

< 2.9

Timeline

Official Publish: August 28th, 2024

Last Modified: September 6th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement