| Titolo | SourceCodester SRMS - Student Result Management System 1.0 Cross Site Scripting (CWE-79) |
|---|
| Descrizione | Stored Cross-Site Scripting (CWE-79) in the Announcement module. Write
handler script/academic/core/new_announcement.php stores $_POST['title'] and
$_POST['announcement'] into tbl_announcements verbatim with no authentication, no
CSRF token and no sanitization, so any unauthenticated client can plant raw HTML/JS.
Dashboards script/student/index.php (lines 111-113) and script/teacher/index.php
(lines 130-132) render the stored values with echo and no htmlspecialchars output
encoding, so the script executes for every student (level 3) and teacher (level 2)
who opens the dashboard. PoC: POST
http://192.168.179.130/script/academic/core/new_announcement with announcement=<img
src=x onerror=alert(document.cookie)> and audience=2 returns 302 and stores the row;
logging in as a default account (e.g. student [email protected] / 12345678 or teacher
[email protected] / 12345678) shows the script executing and reading document.cookie,
including the persistent session token __SRMS__key (4320 min) -> session
hijacking/account takeover. A stdlib/requests Python auto-exploit (included in the
report) plants and verifies the raw re-echo. Fix: htmlspecialchars on all DB echoes,
HTML Purifier allow-list for the rich-text body, and add session/role checks + CSRF
tokens on every core write handler. CVSS v3.1 7.1 High
(AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).
The detailed report can be found at the GitHub link.
The report archive password is: abc123..
|
|---|
| Utente | yuanchao (UID 99964) |
|---|
| Sottomissione | 07/09/2026 16:20 (25 giorni fa) |
|---|
| Moderazione | 02/10/2026 06:16 (25 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 412921 [SourceCodester Student Result Management System 1.0 Announcement new_announcement.php title/announcement cross site scripting] |
|---|
| Punti | 20 |
|---|