| タイトル | SourceCodester Student Grades Management System 1.0 Cross Site Scripting |
|---|
| 説明 | A Stored Cross-Site Scripting (XSS) vulnerability exists in the administrative user management functionality of the Student Grades Management System.
The vulnerability occurs when the application processes user input supplied through the username parameter during the user creation process.
The affected endpoint is:
/student-grades-management-system/admin.php
During user creation, the application accepts several parameters via an HTTP POST request, including:
first_name
last_name
username
email
role
password
The value provided in the username parameter is stored in the backend database without proper validation or sanitization.
Because the stored value is later rendered within the application interface without applying output encoding, malicious HTML or JavaScript code can be executed in the browser of users who view the affected data.
An attacker can exploit this vulnerability by submitting specially crafted input in the username field. Once stored, the payload becomes persistent and executes when the application displays the stored username.
payload used during testing:
<script>alert(1)</script>
In the captured request, the payload was injected as part of the username value:
username=admingdkxf<script>alert(1)</script>s6zk6
When the affected page is loaded, the injected script executes in the browser.
Because the payload is stored server-side and executed whenever the affected data is rendered, this issue is classified as a Stored (Persistent) Cross-Site Scripting vulnerability.
|
|---|
| ソース | ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Student%20Grades%20Management%20System%20username%20Parameter.md |
|---|
| ユーザー | AhmadMarzouk (UID 95993) |
|---|
| 送信 | 2026年03月22日 19:51 (7 月 ago) |
|---|
| モデレーション | 2026年04月05日 18:53 (14 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 327602 [SourceCodester Student Grades Management System 1.0 Manage Users Page /admin.php add_user first_name/last_name クロスサイトスクリプティング] |
|---|
| ポイント | 0 |
|---|