| タイトル | SourceCodester Student Management System 1.0 Cross Site Scripting |
|---|
| 説明 | A stored cross-site scripting (XSS) vulnerability exists in Student Grades Management System 1.0 by SourceCodester. The vulnerability affects the Grades Management module, specifically the "Remarks" parameter when adding or managing grade records.
The application does not properly sanitize or encode user-supplied input before storing it in the backend database. As a result, malicious JavaScript code can be injected and permanently stored.
An authenticated attacker with teacher privileges can insert a crafted payload into the Remarks field. The injected script executes immediately after submission and is triggered again whenever the affected records are viewed, including within the Manage Grades section and the Teacher Dashboard.
Successful exploitation allows execution of arbitrary JavaScript in the context of authenticated users. This may lead to session hijacking, unauthorized actions, data manipulation, or redirection to malicious external resources. |
|---|
| ソース | ⚠️ https://gist.github.com/Denilxavier/7fed710040ba7455e9cb499a989c9d69 |
|---|
| ユーザー | Denil Xavier (UID 95932) |
|---|
| 送信 | 2026年02月26日 09:42 (7 月 ago) |
|---|
| モデレーション | 2026年03月07日 21:39 (9 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 332766 [SourceCodester Student Grades Management System 1.0 Add New Grade Page /grades.php remarks クロスサイトスクリプティング] |
|---|
| ポイント | 0 |
|---|