Executive brief
A security vulnerability exists in the itsourcecode Fees Management System, a software used for managing educational or service fees. An attacker can exploit this flaw to run malicious scripts in the web browser of a user who clicks on a specially crafted link. This could lead to unauthorized actions being performed on behalf of the user, such as session hijacking or the theft of sensitive information.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in itsourcecode Fees Management System version 1.0. The flaw is located in the '/navbar.php' component, where the 'page' URL parameter is reflected into the page output without sufficient sanitization or encoding. A remote, unauthenticated attacker can exploit this by tricking a victim into clicking a malicious URL containing a JavaScript payload. Successful exploitation allows the execution of arbitrary script code in the context of the victim's browser session, potentially leading to session cookie theft or unauthorized administrative actions. Public exploit code has been released.
Affected products
- itsourcecode Fees Management System 1.0
Timeline
- 2026-05-22: disclosed: Initial vulnerability report on GitHub
- 2026-06-04: advisory: NVD/VulDB advisory published