| 제목 | SourceCodester Student Management System 1.0 Cross Site Scripting |
|---|
| 설명 | A stored cross-site scripting (XSS) vulnerability exists in Student Grades Management System 1.0 by SourceCodester. The vulnerability affects the Grades Management module, specifically the "Remarks" parameter when adding or managing grade records.
The application does not properly sanitize or encode user-supplied input before storing it in the backend database. As a result, malicious JavaScript code can be injected and permanently stored.
An authenticated attacker with teacher privileges can insert a crafted payload into the Remarks field. The injected script executes immediately after submission and is triggered again whenever the affected records are viewed, including within the Manage Grades section and the Teacher Dashboard.
Successful exploitation allows execution of arbitrary JavaScript in the context of authenticated users. This may lead to session hijacking, unauthorized actions, data manipulation, or redirection to malicious external resources. |
|---|
| 원천 | ⚠️ https://gist.github.com/Denilxavier/7fed710040ba7455e9cb499a989c9d69 |
|---|
| 사용자 | Denil Xavier (UID 95932) |
|---|
| 제출 | 2026. 02. 26. AM 09:42 (7 개월 ago) |
|---|
| 모더레이션 | 2026. 03. 07. PM 09:39 (9 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 332766 [SourceCodester Student Grades Management System 1.0 Add New Grade Page /grades.php 비고 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 0 |
|---|