Executive brief
StudentManage is a web-based application used to manage student, teacher, and course records. A security vulnerability in the teacher management module allows an administrative user to inject malicious scripts into the system. If another user views the compromised teacher records, the script could execute in their browser, potentially leading to unauthorized actions or the theft of session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in StudentManage v1.0 within the 'Add A New Teacher' module. The application fails to properly sanitize or neutralize user-supplied input in the teacher's name field before storing it in the database and rendering it back to the user interface. An attacker with administrative privileges can inject arbitrary JavaScript, which executes in the context of any user (such as another administrator) who views the teacher management page. The vulnerability is tracked as CWE-79 and requires high privileges to exploit, but impacts the integrity and confidentiality of the victim's session.
Affected products
- DayCloud StudentManage 1.0
Timeline
- 2025-07-18: disclosed: Vulnerability reported on GitHub issues and published by NVD