Executive brief
SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules, contains a security flaw that allows for cross-site scripting (XSS). An attacker can exploit this by tricking a user into clicking a malicious link, which could lead to the theft of login session information or unauthorized actions performed on behalf of the user. This could compromise the privacy of students and staff using the system.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the /exam.php component. The vulnerability is caused by insufficient sanitization and output encoding of the 'day' GET parameter. A remote, unauthenticated attacker can exploit this by crafting a malicious URL containing a JavaScript payload; when a victim visits this URL, the script executes in their browser context. This can lead to session hijacking via cookie theft or unauthorized state-changing operations. A public proof-of-concept (PoC) using the payload <script>prompt(/xss/);</script> has been disclosed.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-06-11: disclosed: Initial disclosure on GitHub by zzb1388
- 2026-07-14: advisory: CVE published and NVD record created