| शीर्षक | QDOCS Smart School : School Management System 7.2 Cross Site Scripting |
|---|
| विवरण | A stored cross-site scripting (XSS) vulnerability exists in Smart School: School Management System within the Front Office → Admission Enquiry → Follow-up Admission Enquiry module, accessible via the /admin/enquiry endpoint. The application fails to properly sanitize or encode user-supplied input in the “Note” field. An authenticated low-privileged user (e.g., Receptionist) can inject malicious JavaScript that is stored in the database and executed when the affected record is viewed by higher-privileged users such as Admin or Superadmin. This may result in client-side code execution within the victim’s browser session, potentially leading to information disclosure and unauthorized actions performed with the victim’s privileges. |
|---|
| स्रोत | ⚠️ https://github.com/smitp1553/School_management_System/tree/main |
|---|
| उपयोगकर्ता | Casmit2004 (UID 96320) |
|---|
| सबमिशन | 10/03/2026 05:37 PM (5 महीनों पहले) |
|---|
| संयम | 27/03/2026 02:48 PM (17 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 353878 [QDOCS Smart School Management System तक 7.2 Admission Enquiry /admin/enquiry Note क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|