| عنوان | SourceCodester Student Management System 1.0 Cross Site Scripting |
|---|
| الوصف | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in SourceCodester Student Grades Management System 1.0. The vulnerability is located in the Subject Name input field within the admin.php Subject module.
The flaw allows a remote authenticated attacker to inject arbitrary scripts (e.g., <script>alert('XSS')</script>) which are persistently stored in the database. This vulnerability demonstrates a significant "Double-Trigger" execution chain:
Immediate Execution: The payload triggers immediately upon the submission of the "Add Subject" form.
Blind Dashboard Execution: The payload triggers automatically on the main Admin Dashboard (admin.php).
Notably, the Dashboard execution occurs even though the Subject Name is not visually rendered in the "Subjects" UI widget. This indicates a Blind XSS scenario where the malicious data is loaded into the page's Document Object Model (DOM) during background data-fetching, allowing for stealthy hijacking of administrative sessions and unauthorized access to student records. |
|---|
| المصدر | ⚠️ https://gist.github.com/archana1122m/8c6047e39e65d3d7eaf1e728e627ae57 |
|---|
| المستخدم | Archana M (UID 95668) |
|---|
| ارسال | 18/02/2026 11:44 AM (8 أشهر منذ) |
|---|
| الاعتدال | 24/02/2026 11:04 PM (6 days later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 165781 [SourceCodester Student Management System 1.0 Subject البرمجة عبر المواقع] |
|---|
| النقاط | 0 |
|---|