| शीर्षक | imvks786 student_management_system 1.0 Stored Cross‑Site Scripting |
|---|
| विवरण | The `add.php` script inserts a new student record by directly concatenating `$_POST` fields (such as `name`, `address`, `fname`, etc.) into an SQL query without any sanitisation:
```php
$name = $_POST['name'];
...
$sql = "INSERT INTO student (name,fname,...) values('$name','$fname',...)";
```
Later, multiple pages display student data by echoing the raw database values directly into HTML without using htmlspecialchars() or any other output encoding:
echo "<td>".$row["name"]."</td>";
echo "<td>".$row["address"]."</td>";
An attacker can submit a student entry containing a malicious payload (e.g., <svg/onload=alert(1337)>) in fields like name or address. When any user (admin, teacher, student) views the student list or profile, the injected script executes in their browser, leading to session theft, cookie hijacking, and further compromise. |
|---|
| स्रोत | ⚠️ https://github.com/imvks786/student_management_system/issues/5 |
|---|
| उपयोगकर्ता | Marry_2026 (UID 98397) |
|---|
| सबमिशन | 25/05/2026 06:49 AM (16 दिन पहले) |
|---|
| संयम | 07/06/2026 09:53 PM (14 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 369151 [imvks786 student_management_system तक 9599b560ad3c3b83e75d328b76bedcd489ef1f46 /add.php name/address/fname क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|