| 제목 | SourceCodester SRMS - Student Result Management System 1.0 Cross Site Scripting (CWE-79) |
|---|
| 설명 | Stored Cross-Site Scripting (CWE-79) in the Announcement module. Write
handler script/academic/core/new_announcement.php stores $_POST['title'] and
$_POST['announcement'] into tbl_announcements verbatim with no authentication, no
CSRF token and no sanitization, so any unauthenticated client can plant raw HTML/JS.
Dashboards script/student/index.php (lines 111-113) and script/teacher/index.php
(lines 130-132) render the stored values with echo and no htmlspecialchars output
encoding, so the script executes for every student (level 3) and teacher (level 2)
who opens the dashboard. PoC: POST
http://192.168.179.130/script/academic/core/new_announcement with announcement=<img
src=x onerror=alert(document.cookie)> and audience=2 returns 302 and stores the row;
logging in as a default account (e.g. student [email protected] / 12345678 or teacher
[email protected] / 12345678) shows the script executing and reading document.cookie,
including the persistent session token __SRMS__key (4320 min) -> session
hijacking/account takeover. A stdlib/requests Python auto-exploit (included in the
report) plants and verifies the raw re-echo. Fix: htmlspecialchars on all DB echoes,
HTML Purifier allow-list for the rich-text body, and add session/role checks + CSRF
tokens on every core write handler. CVSS v3.1 7.1 High
(AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).
The detailed report can be found at the GitHub link.
The report archive password is: abc123..
|
|---|
| 사용자 | yuanchao (UID 99964) |
|---|
| 제출 | 2026. 09. 07. PM 04:20 (25 날 ago) |
|---|
| 모더레이션 | 2026. 10. 02. AM 06:16 (25 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 412921 [SourceCodester Student Result Management System 1.0 Announcement new_announcement.php title/announcement 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|