Executive brief
A vulnerability exists in the SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules. An attacker can inject malicious scripts into the system that execute when a user views certain pages. This could lead to unauthorized actions being performed in the user's browser, such as the theft of login session information or the defacement of the web interface.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0. The flaw is located in the '/forsubject.php' file due to insufficient sanitization of the 'subject' parameter. A remote attacker can exploit this by tricking a user into clicking a specially crafted link containing a malicious script payload. If successful, the attacker can execute arbitrary JavaScript in the context of the victim's browser session. This can be used to steal session cookies or perform unauthorized actions on behalf of the user. No authentication is required to initiate the attack.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-06-10: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-07-13: advisory: NVD/VulDB advisory published