CVE-2026-78055 in Class and Exam Timetabling System
Summary
by MITRE • 08/23/2026
A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /BSIT2.php. The manipulation of the argument course leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/23/2026
The SourceCodester Class and Exam Timetabling System version 1.0 contains a critical input validation flaw within its web application interface, specifically located in the file BSIT2.php. This vulnerability manifests as an Unrestricted Upload of Web-Content with Malicious Code or Cross-Site Scripting (XSS) depending on how the payload is delivered and executed, but based on the description provided, it is primarily characterized by a reflected cross-site scripting issue triggered through the manipulation of the course argument parameter. The application fails to properly sanitize user-supplied input before processing it for display in the web browser environment. When an attacker crafts a malicious URL containing script tags or other executable JavaScript payloads within the course parameter value and induces a victim to visit this link, the vulnerable server-side code incorporates this unsanitized data directly into the HTTP response without adequate encoding or filtering mechanisms.
This technical flaw allows for remote exploitation by any unauthenticated user who can trick an authenticated administrator or regular user into accessing the crafted URL. The operational impact of such cross-site scripting vulnerabilities is significant as it enables attackers to execute arbitrary JavaScript code in the context of the victim's browser session. This capability facilitates a range of malicious activities including session hijacking, where the attacker steals authentication cookies and tokens to impersonate the legitimate user; credential harvesting through fake login forms injected into the page content; or defacement of the application interface by modifying DOM elements. In administrative contexts such as class timetabling systems, successful exploitation could lead to unauthorized modifications of course schedules, exam times, or student records if the victim holds elevated privileges, thereby compromising the integrity and availability of critical academic data.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack vector is classified under ATT&CK technique T1059 Command and Scripting Interpreter via JavaScript execution within the browser environment. Furthermore, it relates to CWE-601 URL Redirection to Untrusted Site which may be involved if the vulnerability allows for phishing attacks or redirections following the initial script execution. The public disclosure of exploit code significantly lowers the barrier to entry for attackers, increasing the likelihood of automated scanning and opportunistic exploitation against systems running this specific version of the software without immediate patches applied by developers.
Mitigation strategies must focus on implementing robust input validation and output encoding practices within the BSIT2.php file and related components handling course data. Developers should enforce strict allow-listing for expected input formats, ensuring that only valid alphanumeric characters or predefined identifiers are accepted in the course parameter. Additionally, all dynamic content rendered to the browser must be properly encoded using context-specific escaping techniques such as HTML entity encoding for text contexts or JavaScript string escaping where applicable. Implementing a Content Security Policy (CSP) header can also mitigate the impact of successful XSS attacks by restricting the sources from which scripts are allowed to execute. Immediate patching is recommended, and in cases where code modification is not feasible, deploying a Web Application Firewall with rules tuned to detect and block common cross-site scripting payloads targeting this specific parameter provides an effective compensating control until permanent remediation is deployed.