CVE-2026-78054 in Class and Exam Timetabling System
Summary
by MITRE • 08/23/2026
A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /BSIS1.php. Executing a manipulation of the argument course can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The SourceCodester Class and Exam Timetabling System version 1.0 contains a critical security flaw within its web application architecture, specifically located in an unknown function of the file BSIS1.php. This vulnerability is classified as Cross-Site Scripting, commonly referred to by industry standards such as CWE-79 (Improper Neutralization of Input During Web Page Generation). The root cause lies in the insufficient validation and sanitization of user-supplied input before it is processed or rendered back into the browser environment. When an attacker manipulates the course argument passed through this endpoint, the application fails to properly escape special characters that have semantic meaning in HTML and JavaScript contexts. This oversight allows malicious scripts to be injected directly into the web page content served to other users who view the affected data.
From a technical perspective, the vulnerability exploits the lack of output encoding or input filtering mechanisms within the BSIS1.php script. By injecting executable code via the course parameter, an attacker can execute arbitrary JavaScript in the context of the victim's browser session. This is particularly dangerous because it occurs remotely without requiring authentication for certain parts of the application, making it accessible to a wide range of potential attackers. The presence of publicly available exploits significantly lowers the barrier to entry for malicious actors, increasing the likelihood of automated attacks and widespread compromise across systems running this specific version of the software.
The operational impact of this vulnerability extends beyond simple script execution. Successful exploitation can lead to session hijacking, where an attacker steals valid authentication cookies or tokens from unsuspecting users. This allows the adversary to impersonate legitimate users, potentially gaining unauthorized access to sensitive academic records, personal information, and administrative functions within the timetabling system. Furthermore, attackers may use this vector to deface web pages, redirect users to malicious sites hosting malware, or conduct phishing campaigns that appear trustworthy because they originate from a trusted domain. The integrity of the application is compromised as user data can be manipulated visually through injected scripts, leading to confusion and loss of trust among students and faculty members relying on the system for scheduling information.
In alignment with the MITRE ATT&CK framework, this vulnerability maps directly to techniques involving Client-Side Scripting Injection (T1059) and potentially Credential Access via Browser Session Hijacking if session tokens are stolen. The attack vector is classified as Remote Code Execution through a web application interface, emphasizing the need for robust input validation at every stage of data processing. To mitigate this risk, immediate remediation should focus on implementing strict output encoding using context-aware methods such as HTML entity encoding or JavaScript string escaping depending on where the variable is rendered. Additionally, developers must enforce rigorous input validation to reject any non-alphanumeric characters in fields that do not explicitly require them. Deploying a Web Application Firewall can provide an additional layer of defense by detecting and blocking known exploit patterns associated with XSS attacks while long-term fixes are implemented.