| Название | SourceCodester Student Management System 1.0 Cross Site Scripting |
|---|
| Описание | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in SourceCodester Student Grades Management System 1.0. The vulnerability is located in the Subject Name input field within the admin.php Subject module.
The flaw allows a remote authenticated attacker to inject arbitrary scripts (e.g., <script>alert('XSS')</script>) which are persistently stored in the database. This vulnerability demonstrates a significant "Double-Trigger" execution chain:
Immediate Execution: The payload triggers immediately upon the submission of the "Add Subject" form.
Blind Dashboard Execution: The payload triggers automatically on the main Admin Dashboard (admin.php).
Notably, the Dashboard execution occurs even though the Subject Name is not visually rendered in the "Subjects" UI widget. This indicates a Blind XSS scenario where the malicious data is loaded into the page's Document Object Model (DOM) during background data-fetching, allowing for stealthy hijacking of administrative sessions and unauthorized access to student records. |
|---|
| Источник | ⚠️ https://gist.github.com/archana1122m/8c6047e39e65d3d7eaf1e728e627ae57 |
|---|
| Пользователь | Archana M (UID 95668) |
|---|
| Представление | 18.02.2026 11:44 (8 месяцы назад) |
|---|
| Модерация | 24.02.2026 23:04 (6 days later) |
|---|
| Статус | Дубликат |
|---|
| Запись VulDB | 165781 [SourceCodester Student Management System 1.0 Subject межсайтовый скриптинг] |
|---|
| Баллы | 0 |
|---|