| 제목 | sourcecodester Student Grades Management System 1.0 Improper Input Validation |
|---|
| 설명 | The "Student Grades Management System" application stores user-supplied input (first name / last name / other profile fields) in the database and later outputs the values directly into HTML pages without escaping. An attacker with the ability to create or edit a user (e.g., via the admin UI or signup) can store JavaScript that executes in the browser of any admin/teacher who views the user list or dashboard. This is a stored XSS — critical because it can lead to admin session theft, user takeover, CSRF actions, or full account takeover when combined with other site behaviors. |
|---|
| 원천 | ⚠️ https://github.com/sidzeroday/sourcecodester_cve/blob/main/README.md |
|---|
| 사용자 | sidzeroday (UID 90256) |
|---|
| 제출 | 2025. 10. 02. AM 11:37 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 10. 08. PM 12:21 (6 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 327602 [SourceCodester Student Grades Management System 1.0 Manage Users Page /admin.php add_user first_name/last_name 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|