Invia #1042948: H.R. Shadhin / CloudSchool (GitHub: hrshadhin) CloudSchool v3.0.1 Stored Cross-Site Scripting (CWE-79)

Summary: F1 Stored XSS in admin-managed website content, enabling superadmin session riding

Technical details: Admin-managed rich-text fields (event descriptions, FAQ answers, About content, class profiles) are stored
without any server-side sanitization and are rendered on public, unauthenticated pages using
Blade's unescaped {!! !!} operator. An Admin-role user (below superadmin) can therefore plant
persistent JavaScript that executes in the browser of every visitor of the school's public website — including
the superadmin. Because the backend pages expose a CSRF meta tag readable by scripts, the payload
can issue authenticated state-changing requests as the victim, escalating to full superadmin takeover.
It also enables mass visitor compromise (defacement, malware delivery) with zero interaction beyond visiting
the page.

POC:-

POC:/
1. POST /event (admin session) → EventController@store() → $data = $request->all() (line 48)
2. description passes validation ('description' => 'required' — no sanitization, line 43) → Event::create($data) (line 83) → stored in events.description
3. GET /events-details/{slug} (unauthenticated) → HomeController@eventDetails → frontend/event_details.blade.php:57 → {!! $event->description !!} — raw HTML inside <div>
4. Also rendered (first 80 chars) on the public listing GET /events via {!! substr($event->description,0,80) !!}
5. Same unescaped-sink pattern exists for: {!! $event->cover_video !!} (attacker-controlled embed code), FAQ answers {!! $qa->a !!}, About content {!! $aboutContent->key_point_*_content !!} / intro_video_embed_code, and class-profile description/outline.

Evidence / affected locations: Endpoints POST /event , POST /event/{id} (EventController@store/update). Same sink pattern for FAQ, About content, class profiles (Website permission group). Method / Role POST / any user holding the Website permission (the standard Admin role holds 181/194 permissions including Website; roles 2–7 do not). Source files app/Http/Controllers/Backend/EventController.php:20-87,90-170 — $data = $request->all(); Event::create($data) resources/views/frontend/event_details.blade.php:52,57 — {!! $event->description !!} resources/views/frontend/event.blade.php:55,60 Confirmed Yes — dynamically , payload verified in raw server-rendered output; test record removed after capture.

Assessment status: Confirmed: attacker-controlled HTML is emitted verbatim in the HTML body of public pages — an executable XSS context. Impact chain to superadmin takeover documented in the report's exploitation notes.

• Fonte: ⚠️ https://github.com/hrshadhin/school-management-system
• Utente: ChetanPujari (UID 101747)
• Sottomissione: 19/10/2026 08:35 (26 giorni fa)
• Moderazione: 13/11/2026 20:31 (26 days later)
• Stato: Accettato
• Voce VulDB: 437281 [hrshadhin CloudSchool fino a 3.0.1 Event Description EventController.php data cross site scripting]
• Punti: 20