Executive brief
StudentManage is a web-based application used for managing student records, grades, and administrative tasks. A security flaw in the student registration module allows an attacker to inject malicious scripts into the system. If an administrator views the compromised student record, the script could execute in their browser, potentially leading to unauthorized actions or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in StudentManage v1.0 within the 'Add A New Student' module. The application fails to properly sanitize user-supplied input in the student name field before storing it in the database and rendering it on the management page. An attacker with high privileges (such as an administrative account) can inject a malicious script payload into the name field. When another user, typically an administrator, views the student list or the specific student's profile, the payload executes in their browser context. This can be used to hijack sessions or perform unauthorized actions on behalf of the victim.
Affected products
- DayCloud StudentManage 1.0
Timeline
- 2025-07-18: disclosed: Vulnerability reported via GitHub issues and assigned CVE-2025-50583.
- 2025-07-18: advisory: NVD published the vulnerability details.