Executive brief
The Class and Exam Timetabling System, a web application used for managing academic schedules, contains a security flaw that allows for cross-site scripting (XSS). An attacker can exploit this by injecting malicious scripts into the 'course' parameter, which could lead to the theft of user session information or unauthorized actions performed on behalf of legitimate users. This could compromise the privacy of staff and students using the system.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the /CYS.php component. The vulnerability is caused by insufficient sanitization and output encoding of the 'course' parameter. A remote attacker with low privileges can inject arbitrary JavaScript payloads (e.g., <script>prompt(/xss/);</script>) that are subsequently executed in the browsers of other users when they view the affected page. This can lead to session hijacking via cookie theft or unauthorized state-changing operations. The exploit has been publicly disclosed.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-06-13: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-07-19: advisory: NVD publication date