# CVE-2025-8541


Stored XSS in i-Educar via public_uf_cad.php (With PoC and Screenshots)

<!--more-->

> ***🇧🇷 Ler em [Português](http://karinagante.github.io/pt-br/cve-2025-8541).***

## CVE-2025-8541

### Introduction

<p align="justify">While reviewing the federal unit module in the <b><a href="https://github.com/portabilis/i-educar" target=_blank>i-Educar</a></b> system, I identified yet another stored XSS vulnerability — this time in the <b>/intranet/public_uf_cad.php</b> endpoint. The <b>nome</b> parameter accepts and stores malicious scripts without any input sanitization. </br> Once submitted, the payload is automatically executed when the federal unit listing page is accessed. This vulnerability was officially assigned as <b><a href="https://www.cve.org/CVERecord?id=CVE-2025-8541" target=_blank>CVE-2025-8541</a></b>. </br> Below, I break down the technical details, PoC steps, and real-world risks involved. </p>

### What is CVE-2025-8541?

<p align="justify"><b><a href="https://www.cve.org/CVERecord?id=CVE-2025-8541" target=_blank>CVE-2025-8541</a></b> is a stored Cross-Site Scripting (XSS) vulnerability located in the <b>/intranet/public_uf_cad.php</b> endpoint of the <b><a href="https://github.com/portabilis/i-educar" target=_blank>i-Educar</a></b> application. </br> The flaw allows attackers to inject scripts into the <b>nome</b> field, which are then stored on the server and executed automatically when the page <b>/intranet/public_uf_lst.php</b> is accessed by users. </p>

### Technical Details

➤ **Vulnerable Endpoint:** `/intranet/public_uf_cad.php`

➤ **Affected Parameter:** `nome`

➤ **Trigger Page:** `/intranet/public_uf_lst.php`

> ➤ **Payload Used** 
> ```html
><img src=x onerror=alert(1)>
>```

### Proof of Concept (PoC)

To reproduce this vulnerability, follow the steps below:

➤ **Access the endpoint:** `/intranet/public_uf_cad.php`

➤ **Select "Brasil"** in the first field ("País")

➤ **Choose any option in the second field** ("Sigla Uf")

➤ **Insert the payload in the third field:** `Nome`

➤ **Click on:** “Salvar”

> <p align="justify">The page <code>/intranet/public_uf_lst.php</code> will be triggered automatically, executing the XSS:</p>

<p align="center">
<img src="/images/CVE-2025-8541/PoC1.png">
</p>

|   Parameter `nome`         |
|:------------:|
| ![](/images/CVE-2025-8541/PoC2.png)    |

{{< admonition tip Report >}} 
You can read the full technical report here:

{{< fa-icon regular github >}} 
***[CVE-2025-8541 Report](https://github.com/KarinaGante/KGSec/blob/main/CVEs/i-educar/CVE-2025-8541.md)***
{{< /admonition >}}

### Impact

This Cross-Site Scripting (XSS) vulnerability can be exploited to:

- Steal session cookies (session hijacking);
- Install malware on victims' devices;
- Steal credentials stored in the browser;
- Redirect users to malicious websites;
- Deface the application interface;
- Damage the institutional reputation.

### Official Sources

The issue was responsibly disclosed and registered as:

{{< admonition important References>}} 
{{< fa-icon regular shield >}} 
***[CVE-2025-8541 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2025-8541)***

{{< fa-icon regular database >}} 
***[VulDB Entry](https://vuldb.com/?id.318670)***
{{< /admonition >}}

### Conclusion

<p align="justify"><b><a href="https://www.cve.org/CVERecord?id=CVE-2025-8541" target=_blank>CVE-2025-8541</a></b> is another clear example of how improperly validated input can pose a significant security threat. In this case, even a simple field like “State Name” was enough to allow persistent XSS attacks. </br> Extra care must be taken with administrative interfaces, and developers should enforce strict input sanitization across all user-facing fields — <b>regardless of their perceived importance.</b></p>

## Credits

***Discovered with💜 by [Karina Gante](https://karinagante.github.io/).***

[![LinkedIn](https://skillicons.dev/icons?i=linkedin&theme=dark)](https://www.linkedin.com/in/karina-gante/)
[![GitHub](https://skillicons.dev/icons?i=github&theme=dark)](https://www.github.com/KarinaGante/)
[![gmail](https://skillicons.dev/icons?i=gmail&theme=dark)](mailto:karina.g@aluno.ifsp.edu.br)
[![Instagram](https://skillicons.dev/icons?i=instagram&theme=dark)](https://www.instagram.com/karinovisk02/)

> ***Official Member of [CVE-Hunters](https://www.cvehunters.com/)🏹***
