| Título | mathurvishal CloudClassroom-PHP-Project 5dadec098bfbbf3300d60c3494db3fb95b66e7be Stored Cross-Site Scripting (CWE-79) |
|---|
| Descripción | A stored cross-site scripting vulnerability was confirmed in mathurvishal CloudClassroom-PHP-Project at commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected file is manageassessment2.php and the affected POST parameters are ExamName, Q1, Q2, Q3, Q4, and Q5.
The endpoint redirects unauthenticated requests to the faculty login page but does not terminate PHP execution. An unauthenticated attacker can therefore reach the assessment update routine and persist attacker-controlled content. The stored values are later rendered without context-appropriate HTML encoding in manageassessment2.php. The Q1 through Q5 fields are also rendered to students by takeassessment2.php.
The complete chain was reproduced in an isolated local environment. A POST containing a textarea breakout and SVG onload payload received HTTP 302 but updated the database. A subsequent authenticated request produced an executable SVG element, and Firefox confirmed JavaScript execution in the application origin. The test record was restored after validation.
Root cause: missing execution termination after the authentication redirect, missing server-side authorization on the update path, and missing HTML output encoding.
Suggested classification: CWE-79. Suggested CVSS v3.1: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Confirmed affected commit: 5dadec098bfbbf3300d60c3494db3fb95b66e7be. No fixed commit or release is known.
The vendor was notified publicly before this submission: https://github.com/mathurvishal/CloudClassroom-PHP-Project/issues/9
No CVE is known for this specific file and parameter set, and this issue has not been submitted to another CNA. CVE assignment is requested from VulDB.
Credits: Marcus Chaves ([email protected]) and Fernando Viana ([email protected]).
|
|---|
| Fuente | ⚠️ https://github.com/capivara-research/manageassessment2-stored-xss/blob/main/manageassessment2-stored-xss.md |
|---|
| Usuario | fernando viana (UID 101484) |
|---|
| Sumisión | 2026-10-07 02:15 (hace 29 días) |
|---|
| Moderación | 2026-11-01 16:40 (26 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 429668 [mathurvishal CloudClassroom-PHP-Project manageassessment2.php ExamName/Q1/Q2/Q3/Q4/Q5 secuencias de comandos en sitios cruzados] |
|---|
| Puntos | 20 |
|---|