CVE-2024-45057

Name of the Vulnerable Software and Affected Versions i-Educar versions prior to 2.9

Description A Reflected Cross-Site Scripting (XSS) issue was identified in the dynamic generation of HTML fields. The file ieducar/intranet/include/clsCampos.inc.php does not properly validate or sanitize user-controlled input, leading to the issue. Any page that uses this implementation is affected, such as "intranet/educar curso lst.php?nm curso=", "intranet/atendidos lst.php?nm pessoa=", "intranet/educar abandono tipo lst?nome=". The lack of sanitization of user-controlled parameters allows an attacker to inject a specific XSS payload, which can be executed in the victim's browser.

Recommendations For versions prior to 2.9, apply the patch contained in commit f2d768534aabc09b2a1fc8a5cc5f9c93925cb273 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable clsCampos.inc.php file until the patch is applied. Avoid using the vulnerable parameters nm curso, nm pessoa, and nome in the affected API endpoints until the issue is resolved. Users are recommended to contact the developer and coordinate an update schedule.