| Title | SourceCodester Simple Student Information System 1.0 Improper Neutralization of Alternate XSS Syntax |
|---|
| Description | Simple Student Information System using PHP contains a reflected cross-site scripting vulnerability in /searchresults.php.
The application reads the GET parameter "searchbox" and passes it through a function called clean(). However, clean() only performs trim() and stripslashes(); it does not perform HTML entity encoding. The value is then printed directly inside the HTML page:
<strong class="title">
Search results for "<?php echo $s; ?>".
</strong>
Because the value is not neutralized with htmlspecialchars() or contextual output encoding, an attacker can create a crafted link containing an event-handler-based payload such as:
<svg/onload=alert("REFLECTED-XSS")>
When an authenticated student opens the crafted link, the payload is rendered as part of the page and executes in the student's browser on the application origin.
This allows attacker-controlled JavaScript to run in a logged-in victim's session. Depending on the deployment and cookie protections, this could be used to perform actions as the victim, alter profile data, capture user input, or target session state.
The issue was verified against the official SourceCodester package for the unversioned node-11400 release. |
|---|
| Source | ⚠️ https://github.com/wsx138/cve/issues/6 |
|---|
| User | W5555 (UID 89057) |
|---|
| Submission | 09/20/2026 16:40 (1 month ago) |
|---|
| Moderation | 10/05/2026 22:40 (15 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 413813 [SourceCodester Simple Student Information System 1.0 searchresults.php clean searchbox cross site scripting] |
|---|
| Points | 20 |
|---|