CVE-2025-9720

How I Found a Stored XSS in i-Educar via TabelaArredondamento/edit (With PoC and Screenshots)

🇧🇷 Ler em Português.

CVE-2025-9720

Introduction

Can you imagine compromising a system just by filling out a single text field? In this post, I’ll show you how a simple vulnerability in the "nome" field of i-Educar allows attackers to execute malicious scripts in the browser of anyone who accesses the page — automatically and without any interaction.

After a full investigation and responsible disclosure, the issue was assigned as CVE-2025-9720.

In this write-up, I share technical details, a step-by-step PoC, screenshots, and the potential impact of this vulnerability.

What is CVE-2025-9720?

CVE-2025-9720 refers to a stored Cross-Site Scripting (XSS) vulnerability in the /module/TabelaArredondamento/edit endpoint of the i-Educar application. Stored XSS occurs when malicious input is stored on the server and executed in the browsers of all users who load the affected page.

For CVE-2025-9720, the vulnerable parameter is nome. This field accepts unfiltered user input, allowing attackers to inject arbitrary JavaScript code.

Technical Details

➤ Vulnerable Endpoint: /module/TabelaArredondamento/edit

➤ Affected Parameter: nome

➤ Payload Used

html

"><img src=x onerror=alert('CVE-Hunters')>

Proof of Concept (PoC)

To confirm the vulnerability, I followed these steps:

➤ Access the endpoint: /module/TabelaArredondamento/edit

➤ In the second field (“Nome”), insert the payload

➤ Click on “Salvar”

Payload will execute automatically after save.

Impact

This Cross-Site Scripting (XSS) vulnerability can be exploited to:

• Steal session cookies (session hijacking);
• Install malware on victims’ devices;
• Steal credentials stored in the browser;
• Redirect users to malicious websites;
• Deface the application interface;
• Damage the institutional reputation.

Official Sources

The vulnerability was reported ethically and assigned as:

Conclusion

Even a single input field without proper validation can open the door to high-impact attacks.

CVE-2025-9720 highlights the importance of input sanitization at every stage of development. If you work with web applications, it’s important to review all user entry points carefully.

Simple oversights like this one can easily go unnoticed but carry serious risks.

Credits

Discovered with💜 by Karina Gante.

Official Member of CVE-Hunters🏹