| 标题 | SourceCodester Student Management System 1.0 Cross Site Scripting |
|---|
| 描述 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in SourceCodester Student Grades Management System 1.0. The vulnerability is located in the Subject Name input field within the admin.php Subject module.
The flaw allows a remote authenticated attacker to inject arbitrary scripts (e.g., <script>alert('XSS')</script>) which are persistently stored in the database. This vulnerability demonstrates a significant "Double-Trigger" execution chain:
Immediate Execution: The payload triggers immediately upon the submission of the "Add Subject" form.
Blind Dashboard Execution: The payload triggers automatically on the main Admin Dashboard (admin.php).
Notably, the Dashboard execution occurs even though the Subject Name is not visually rendered in the "Subjects" UI widget. This indicates a Blind XSS scenario where the malicious data is loaded into the page's Document Object Model (DOM) during background data-fetching, allowing for stealthy hijacking of administrative sessions and unauthorized access to student records. |
|---|
| 来源 | ⚠️ https://gist.github.com/archana1122m/8c6047e39e65d3d7eaf1e728e627ae57 |
|---|
| 用户 | Archana M (UID 95668) |
|---|
| 提交 | 2026-02-18 11時44分 (8 月前) |
|---|
| 管理 | 2026-02-24 23時04分 (6 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 165781 [SourceCodester Student Management System 1.0 Subject 跨网站脚本] |
|---|
| 积分 | 0 |
|---|