| 标题 | itsourcecode Fees Management System Fees Management System V1.0 Reflected Cross-Site Scripting (XSS) |
|---|
| 描述 | A critical Reflected Cross-Site Scripting (XSS) vulnerability exists in the SchoolFees Portal administration panel (version 1.0). The vulnerability stems from the unvalidated page URL parameter in the index.php component (line 72), which is directly reflected in both the PHP include path and client-side JavaScript code without proper sanitization or output encoding.
By crafting a malicious request such as GET /index.php?page=')</script><script>alert(0)</script>(, an attacker can inject arbitrary JavaScript code that executes within the victim’s browser session. The payload ')</script><script>alert(0)</script>( closes the existing JavaScript string and tag context, allowing injection of malicious scripts while bypassing basic syntax checks.
Successful exploitation enables session hijacking (via cookie theft), unauthorized actions on behalf of the victim, sensitive data exfiltration, phishing attacks, and full compromise of user trust. The vulnerability also exposes the application to path traversal risks through the dynamic include($page . '.php') call, though the primary risk is reflected XSS. |
|---|
| 来源 | ⚠️ https://github.com/Gach0ng/vuldb_submit/issues/5 |
|---|
| 用户 | gachong (UID 98198) |
|---|
| 提交 | 2026-05-22 05時35分 (4 月前) |
|---|
| 管理 | 2026-06-04 07時18分 (13 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 367594 [itsourcecode Fees Management System 1.0 index.php page 跨网站脚本] |
|---|
| 积分 | 0 |
|---|