Executive brief
A security vulnerability exists in the manikandan580 School Management System, a platform used for managing educational institution data. An attacker can trick an administrator into executing malicious code within their web browser by sending a specially crafted web request. If successful, this could allow the attacker to hijack administrative sessions, steal sensitive information, or perform unauthorized actions on behalf of the administrator.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the /studentms/admin/contact-us.php endpoint of the School-management-system version 1.0. The root cause is the improper neutralization of user-supplied input, specifically the 'email' POST parameter, which is reflected back into the HTML response without adequate sanitization or output encoding (e.g., failing to use htmlspecialchars). An unauthenticated remote attacker can exploit this by inducing an administrator to submit a crafted request. Successful exploitation allows the execution of arbitrary JavaScript in the context of the administrator's browser session, potentially leading to session cookie theft or unauthorized administrative actions. Mitigation involves implementing strict output encoding and server-side input validation.
Affected products
- manikandan580 School-management-system 1.0
Timeline
- 2026-04-14: disclosed: Initial CVE publication
- 2026-05-10: advisory: CISA-ADP enrichment and CVSS assessment