| 제목 | SourceCodester Student Management System 1.0 Cross Site Scripting |
|---|
| 설명 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in SourceCodester Student Grades Management System 1.0. The vulnerability is located in the Subject Name input field within the admin.php Subject module.
The flaw allows a remote authenticated attacker to inject arbitrary scripts (e.g., <script>alert('XSS')</script>) which are persistently stored in the database. This vulnerability demonstrates a significant "Double-Trigger" execution chain:
Immediate Execution: The payload triggers immediately upon the submission of the "Add Subject" form.
Blind Dashboard Execution: The payload triggers automatically on the main Admin Dashboard (admin.php).
Notably, the Dashboard execution occurs even though the Subject Name is not visually rendered in the "Subjects" UI widget. This indicates a Blind XSS scenario where the malicious data is loaded into the page's Document Object Model (DOM) during background data-fetching, allowing for stealthy hijacking of administrative sessions and unauthorized access to student records. |
|---|
| 원천 | ⚠️ https://gist.github.com/archana1122m/8c6047e39e65d3d7eaf1e728e627ae57 |
|---|
| 사용자 | Archana M (UID 95668) |
|---|
| 제출 | 2026. 02. 18. AM 11:44 (8 개월 ago) |
|---|
| 모더레이션 | 2026. 02. 24. PM 11:04 (6 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 165781 [SourceCodester Student Management System 1.0 Subject 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 0 |
|---|