CVE-2026-104612 in Student Result Management System
Summary
by MITRE • 10/02/2026
A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file script/academic/core/new_announcement.php of the component Announcement Module. The manipulation of the argument title/announcement results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The SourceCodester Student Result Management System version 1.0 contains a critical security flaw within its Announcement Module, specifically located in the file script/academic/core/new_announcement.php. This vulnerability manifests as an Unrestricted Upload of File with Dangerous Type or more accurately in this context, Stored Cross-Site Scripting (XSS) resulting from improper input validation and sanitization mechanisms. The core technical failure lies in the application's handling of the title argument when creating new announcements. Instead of enforcing strict allow-lists for acceptable characters or applying robust encoding strategies such as HTML entity encoding before rendering user-supplied data, the system accepts raw malicious script payloads directly into the database without adequate filtering. This architectural oversight allows an attacker to inject executable JavaScript code that is subsequently stored on the server and served to other users when they view the announcement list or details page.
From a technical perspective, this flaw aligns with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting. The vulnerability enables remote attackers to execute arbitrary web scripts in the context of the vulnerable website's domain. Because the malicious content is stored within the application's backend database, it persists until manually removed by an administrator or through a separate cleanup process. This persistence distinguishes it from reflected XSS attacks and classifies it under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). The attack vector requires no special privileges for the initial injection if the announcement creation interface is accessible to authenticated users, or potentially even unauthenticated users depending on the specific access controls implemented around that endpoint.
The operational impact of this vulnerability is severe due to its potential for widespread exploitation and data theft. Once a malicious script is stored via the title field, every user who accesses the affected page will have their browser execute the injected code. This can lead to session hijacking, where attackers steal authentication cookies or tokens to impersonate legitimate users, including potentially privileged accounts like administrators if they view the compromised announcement. Furthermore, it facilitates credential harvesting through phishing pages that mimic the application's login interface but are hosted on an attacker-controlled server via JavaScript redirections. The integrity of the system is also compromised as attackers can deface web pages or redirect traffic to malicious sites designed for malware distribution.
This vulnerability maps directly to MITRE ATT&CK technique T1059, specifically sub-technique 007 which covers Command and Scripting Interpreter: JavaScript. In the context of browser-based attacks, this falls under TA0005 (Defense Evasion) or TA0006 (Credential Access) depending on the payload's intent. The fact that an exploit has been made public significantly increases the risk landscape, as automated scanning tools and opportunistic attackers can easily leverage known proof-of-concept code to identify and compromise instances of this software in the wild. Organizations relying on this open-source or commercial system are exposed to immediate threats without needing sophisticated custom development skills from adversaries.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution is to implement strict input validation at the point of entry, ensuring that only expected alphanumeric characters, spaces, and basic punctuation are accepted for announcement titles. Additionally, output encoding must be applied consistently whenever user-supplied data is rendered in an HTML context, using libraries or framework features designed specifically for this purpose to prevent script execution. Developers should also consider implementing Content Security Policy (CSP) headers as a defense-in-depth measure to restrict the sources from which scripts can be loaded and executed, thereby mitigating the impact even if XSS occurs. Upgrading to patched versions of the software, if available, is critical, but given that this appears to be an older or niche system, manual code review and patching by developers are likely necessary steps to secure the environment against these persistent threats.