Submeter #932174: codingWithElias school-management-system-php 1.0 Cross Site Scripting

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in codingWithElias school-management-system-php version 1.0.

VULNERABILITY DETAILS:
- Affected File: admin/student-edit.php & admin/student-view.php
- Vulnerable Parameter: fname (First Name)
- Vector: Stored XSS via HTTP POST request

DESCRIPTION:
An authenticated user with administrative privileges can inject arbitrary JavaScript payloads into the 'fname' input field during student creation or editing. The input is stored directly in the database without proper sanitization or output encoding. When any administrator navigates to view student details (admin/student-view.php), the stored script executes automatically in the context of the user's browser session.

PROOF OF CONCEPT (PoC):
1. Log in as Administrator.
2. Navigate to Students -> Add New Student or Edit Student.
3. Insert the following payload into the 'fname' input field:
<script>alert('CVE Stored XSS Tested')</script>
4. Fill in remaining required fields and submit the form.
5. Access the student list or student view page. The payload executes immediately.

IMPACT:
This allows attackers to execute arbitrary client-side code, steal session cookies, or perform unauthorized actions on behalf of the administrator.

• Fonte: ⚠️ https://github.com/elshanmammadoov/CVE-PoC-School-Management-System-PHP-XSS
• Utilizador: Elshan (UID 100604)
• Submissão: 16/08/2026 02h25 (há 2 meses)
• Moderação: 27/09/2026 20h49 (1 month later)
• Estado: Duplicado
• Entrada VulDB: 333806 [codingWithElias School Management System até f1ac334bfd89ae9067cc14dea12ec6ff3f078c01 Edit Student Info Page /student-view.php First Name Script de Site Cruzado]
• Pontos: 0