| عنوان | codingWithElias school-management-system-php 1.0 Cross Site Scripting |
|---|
| الوصف | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in codingWithElias school-management-system-php version 1.0.
VULNERABILITY DETAILS:
- Affected File: admin/student-edit.php & admin/student-view.php
- Vulnerable Parameter: fname (First Name)
- Vector: Stored XSS via HTTP POST request
DESCRIPTION:
An authenticated user with administrative privileges can inject arbitrary JavaScript payloads into the 'fname' input field during student creation or editing. The input is stored directly in the database without proper sanitization or output encoding. When any administrator navigates to view student details (admin/student-view.php), the stored script executes automatically in the context of the user's browser session.
PROOF OF CONCEPT (PoC):
1. Log in as Administrator.
2. Navigate to Students -> Add New Student or Edit Student.
3. Insert the following payload into the 'fname' input field:
<script>alert('CVE Stored XSS Tested')</script>
4. Fill in remaining required fields and submit the form.
5. Access the student list or student view page. The payload executes immediately.
IMPACT:
This allows attackers to execute arbitrary client-side code, steal session cookies, or perform unauthorized actions on behalf of the administrator. |
|---|
| المصدر | ⚠️ https://github.com/elshanmammadoov/CVE-PoC-School-Management-System-PHP-XSS |
|---|
| المستخدم | Elshan (UID 100604) |
|---|
| ارسال | 16/08/2026 02:25 AM (2 أشهر منذ) |
|---|
| الاعتدال | 27/09/2026 08:49 PM (1 month later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 333806 [codingWithElias School Management System حتى f1ac334bfd89ae9067cc14dea12ec6ff3f078c01 Edit Student Info Page /student-view.php First Name البرمجة عبر المواقع] |
|---|
| النقاط | 0 |
|---|