Submit #992609: SourceCodester Simple Student Information System 1.0 Cross Site Scripting

Simple Student Information System using PHP contains a cross-user stored cross-site scripting vulnerability through student profile fields.
During public registration, an attacker can submit an event-handler-based payload in the "firstname" or "lastname" parameter, for example:
firstname = <svg/onload=alert("STORED-XSS")>
lastname = Proof
The application stores these values in the students table without restricting them to safe text. Later, when another authenticated user searches for the malicious student record, /searchresults.php outputs the stored values directly into HTML:
<span>
<strong>Student Name:</strong>
<span><?php echo $row['lastname'].", ".$row['firstname']; ?></span>
</span>
No htmlspecialchars() or contextual output encoding is applied. As a result, the stored SVG event-handler payload is rendered in the victim's browser and executes on the application origin.
This was confirmed by registering a temporary student record containing the payload and then logging in as a different user to search for that record. The browser displayed:
STORED-XSS
This proves that the payload is stored by one account and executed in another authenticated user's browser. Because public registration is available, the attacker does not need an existing privileged account. The victim only needs to view or search for the malicious student record.
Depending on the deployment, this could allow actions to be performed as the victim, profile data to be modified, user input to be captured, or session state to be targeted where cookie protections permit.

• Source: ⚠️ https://github.com/wsx138/cve/issues/7
• User: W5555 (UID 89057)
• Submission: 09/20/2026 16:43 (1 month ago)
• Moderation: 10/05/2026 22:40 (15 days later)
• Status: Accepted
• VulDB entry: 413814 [SourceCodester Simple Student Information System 1.0 Profile Field /register.php firstname/lastname cross site scripting]
• Points: 20