| 제목 | SourceCodester CET Automated Grading System with AI Predictive Analytics (delete "Windows" and type this) 1 Cross Site Scripting |
|---|
| 설명 | A reflected cross-site scripting (XSS) vulnerability exists in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The action GET parameter in /index.php is rendered into the HTML response without sanitization or output encoding.
Affected File: /index.php
Affected Parameter: action (GET)
Affected Code (line 136): $action = $_GET['action'] ?? 'dashboard';
Affected Code (line 557): <?= str_replace('_', ' ', $action) ?>
The user-supplied input is directly embedded in an <h2> tag without htmlspecialchars() or any encoding function.
PoC Steps:
1. Login with any valid credentials (admin, faculty, or student role)
2. Navigate to: /index.php?action=<img src=x onerror=alert(document.cookie)>
3. JavaScript alert fires with the session cookie
Impact: Attacker can craft a URL that steals session cookies or performs actions on behalf of the victim when clicked by an authenticated user. |
|---|
| 원천 | ⚠️ https://www.sourcecodester.com/php/18686/cet-automated-grading-system-ai-predictive-analytics-php-and-mysql.html |
|---|
| 사용자 | Yogender (UID 99560) |
|---|
| 제출 | 2026. 07. 05. AM 11:39 (3 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 20. AM 09:19 (2 months later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 370818 [SourceCodester CET Automated Grading System with AI Predictive Analytics /index.php 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 0 |
|---|