| 标题 | SourceCodester Student Management System 1.0 Cross Site Scripting |
|---|
| 描述 | A stored cross-site scripting (XSS) vulnerability exists in Student Grades Management System 1.0 by SourceCodester. The vulnerability affects the Grades Management module, specifically the "Remarks" parameter when adding or managing grade records.
The application does not properly sanitize or encode user-supplied input before storing it in the backend database. As a result, malicious JavaScript code can be injected and permanently stored.
An authenticated attacker with teacher privileges can insert a crafted payload into the Remarks field. The injected script executes immediately after submission and is triggered again whenever the affected records are viewed, including within the Manage Grades section and the Teacher Dashboard.
Successful exploitation allows execution of arbitrary JavaScript in the context of authenticated users. This may lead to session hijacking, unauthorized actions, data manipulation, or redirection to malicious external resources. |
|---|
| 来源 | ⚠️ https://gist.github.com/Denilxavier/7fed710040ba7455e9cb499a989c9d69 |
|---|
| 用户 | Denil Xavier (UID 95932) |
|---|
| 提交 | 2026-02-26 09時42分 (7 月前) |
|---|
| 管理 | 2026-03-07 21時39分 (9 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 332766 [SourceCodester Student Grades Management System 1.0 Add New Grade Page /grades.php remarks 跨网站脚本] |
|---|
| 积分 | 0 |
|---|