Executive brief
The codingWithElias School Management System contains a cross-site scripting (XSS) vulnerability in the student information editing interface. An attacker can inject malicious scripts through the "First Name" parameter, which would be executed in a user's browser when they view or edit student records. This could allow attackers to steal session credentials, redirect users to phishing pages, or perform unauthorized actions on behalf of legitimate users.
Technical details
The vulnerability is a stored or reflected cross-site scripting (XSS) flaw in the /student-view.php file's Edit Student Info Page component. The First Name parameter does not properly sanitize or encode user input before rendering it in the HTML response. An attacker can inject arbitrary JavaScript code through this parameter, which executes in the context of any user viewing the affected page. Exploitation requires network access to the application and does not require authentication. The vulnerability is publicly exploitable and proof-of-concept code has been released. Patches have not been provided, as the vendor did not respond to early disclosure.
Affected products
- codingWithElias School Management System up to f1ac334bfd89ae9067cc14dea12ec6ff3f078c01
Timeline
- 2025-11-30: disclosed
- 2025-11-30: advisory: CVE-2025-13795 published