Executive brief
A vulnerability exists in a PHP-based student management system that allows attackers to inject malicious scripts into admission forms. When a school administrator views the submitted applications, these scripts execute in their browser, potentially allowing the attacker to steal session information or perform unauthorized administrative actions. This could lead to a full compromise of the student database and management functions.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the admission_form_check.php component of the student_management_system_by_php project. The root cause is a failure to sanitize user-supplied input in the 'Message' POST parameter before storing it in the database. When an administrator accesses the admissions.php page, the application retrieves and renders this data without proper output encoding, allowing for arbitrary JavaScript execution in the administrator's browser context. An attacker can exploit this to hijack administrative sessions or perform unauthorized actions. As of the advisory date, the project has not responded to the issue report, and no official patch is available.
Affected products
- raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1
Timeline
- 2026-05-08: disclosed: Issue reported on GitHub repository
- 2026-06-01: advisory: CVE published by VulDB/NVD