| 제목 | codingWithElias school-management-system-php 1.0 Cross Site Scripting |
|---|
| 설명 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in codingWithElias school-management-system-php version 1.0.
VULNERABILITY DETAILS:
- Affected File: admin/student-edit.php & admin/student-view.php
- Vulnerable Parameter: fname (First Name)
- Vector: Stored XSS via HTTP POST request
DESCRIPTION:
An authenticated user with administrative privileges can inject arbitrary JavaScript payloads into the 'fname' input field during student creation or editing. The input is stored directly in the database without proper sanitization or output encoding. When any administrator navigates to view student details (admin/student-view.php), the stored script executes automatically in the context of the user's browser session.
PROOF OF CONCEPT (PoC):
1. Log in as Administrator.
2. Navigate to Students -> Add New Student or Edit Student.
3. Insert the following payload into the 'fname' input field:
<script>alert('CVE Stored XSS Tested')</script>
4. Fill in remaining required fields and submit the form.
5. Access the student list or student view page. The payload executes immediately.
IMPACT:
This allows attackers to execute arbitrary client-side code, steal session cookies, or perform unauthorized actions on behalf of the administrator. |
|---|
| 원천 | ⚠️ https://github.com/elshanmammadoov/CVE-PoC-School-Management-System-PHP-XSS |
|---|
| 사용자 | Elshan (UID 100604) |
|---|
| 제출 | 2026. 08. 16. AM 02:25 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 27. PM 08:49 (1 month later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 333806 [codingWithElias School Management System 까지 f1ac334bfd89ae9067cc14dea12ec6ff3f078c01 Edit Student Info Page /student-view.php First Name 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 0 |
|---|