| शीर्षक | sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0 Stored Cross-Site Scripting |
|---|
| विवरण | The backend dashboards (admin, student, teacher) display detailed information about students and teachers by directly echoing database values without any HTML entity encoding. A typical example from `admin_dashboard.php`:
```php
<input type="text" id="btn1" value="<?php echo $row['name']?>" disabled>
```
Because $row['name'] is output as‑is inside an HTML attribute, an attacker who previously inserted a malicious payload (e.g., via Vulnerability #2 – Unauthorised Data Insertion) into the name field can break out of the attribute and inject arbitrary JavaScript. When an administrator or other user views the dashboard, the injected script executes in their browser. |
|---|
| स्रोत | ⚠️ https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues/3 |
|---|
| उपयोगकर्ता | Yuki-U (UID 97865) |
|---|
| सबमिशन | 03/05/2026 10:47 PM (1 महीना पहले) |
|---|
| संयम | 29/05/2026 07:06 PM (26 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 367290 [sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0 Dashboard Page नाम क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|