Executive brief
A security vulnerability has been identified in the SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules. An attacker can exploit this flaw to inject malicious scripts into the application, which are then executed in the browsers of other users. This could lead to unauthorized actions being performed on behalf of users, the theft of session cookies, or the redirection of users to fraudulent websites.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the '/subject.php' file. The root cause is the improper neutralization of user-supplied input in the 'subject' parameter before it is rendered back to the web page. A remote, unauthenticated attacker can exploit this by tricking a user into clicking a specially crafted link containing a malicious payload. Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking or unauthorized data access. A public exploit (PoC) is available.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-06-10: disclosed: Vulnerability details shared on GitHub by researcher zzb1388
- 2026-07-13: advisory: NVD/VulDB advisory published