Executive brief
A vulnerability exists in the Student Grades Management System, a web application used for managing academic records. An attacker with teacher-level access can inject malicious scripts into classroom descriptions. When an administrator or another user views the affected classroom page, the script executes automatically, potentially leading to account takeover, theft of sensitive session information, or unauthorized actions within the system.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Student Grades Management System 1.0 within the 'create_classroom' function of /classroom.php. The application fails to sanitize user-supplied input in the 'name' and 'description' arguments before storing them in the database and rendering them on the My Classrooms Management Page. An attacker with high privileges (e.g., a teacher account) can inject arbitrary JavaScript, such as '<img src=1 onerror=alert(1)>'. The payload executes in the context of any user, including administrators, who navigates to the affected page. This can lead to session hijacking via cookie theft or unauthorized administrative actions. No patch is currently documented in the advisory.
Affected products
- SourceCodester Student Grades Management System 1.0
Timeline
- 2025-11-18: advisory: Initial disclosure and NVD publication