| タイトル | ITSOURCECODE Student Management System 1.0 Improper Neutralization of Alternate XSS Syntax |
|---|
| 説明 | The ITSOURCECODE Student Management System version 1.0, developed and distributed by ITSOURCECODE, is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Add Student module, specifically within the Student Profile Picture file upload functionality. The application allows users with administrative access to upload SVG files without performing adequate server-side validation or sanitization. Because SVG is an XML-based format capable of embedding JavaScript, a malicious payload uploaded as a student profile image is stored on the server and later rendered by the browser. When the uploaded image is accessed through the Manage Student module or opened directly in a new browser tab, the embedded JavaScript executes in the context of the application, resulting in persistent client-side code execution and exposing authenticated users to security risks. |
|---|
| ソース | ⚠️ https://github.com/AS-AbdulSamad/CVE-1/tree/main |
|---|
| ユーザー | AS-AbdulSamad (UID 95469) |
|---|
| 送信 | 2026年02月10日 22:57 (8 月 ago) |
|---|
| モデレーション | 2026年02月21日 16:14 (11 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 347311 [itsourcecode Student Management System 1.0 Add Student /add_student/ クロスサイトスクリプティング] |
|---|
| ポイント | 20 |
|---|