| عنوان | SourceCodester Student Management System 1.0 Cross Site Scripting |
|---|
| الوصف | A stored cross-site scripting (XSS) vulnerability exists in Student Grades Management System 1.0 by SourceCodester. The vulnerability affects the Grades Management module, specifically the "Remarks" parameter when adding or managing grade records.
The application does not properly sanitize or encode user-supplied input before storing it in the backend database. As a result, malicious JavaScript code can be injected and permanently stored.
An authenticated attacker with teacher privileges can insert a crafted payload into the Remarks field. The injected script executes immediately after submission and is triggered again whenever the affected records are viewed, including within the Manage Grades section and the Teacher Dashboard.
Successful exploitation allows execution of arbitrary JavaScript in the context of authenticated users. This may lead to session hijacking, unauthorized actions, data manipulation, or redirection to malicious external resources. |
|---|
| المصدر | ⚠️ https://gist.github.com/Denilxavier/7fed710040ba7455e9cb499a989c9d69 |
|---|
| المستخدم | Denil Xavier (UID 95932) |
|---|
| ارسال | 26/02/2026 09:42 AM (7 أشهر منذ) |
|---|
| الاعتدال | 07/03/2026 09:39 PM (9 days later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 332766 [SourceCodester Student Grades Management System 1.0 Add New Grade Page /grades.php ملاحظات البرمجة عبر المواقع] |
|---|
| النقاط | 0 |
|---|