Executive brief
A vulnerability exists in the SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules. An attacker can inject malicious scripts into the system that execute when other users view certain pages. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0. The issue is located in the '/forCYS.php' file due to insufficient sanitization of the 'course' parameter. A remote attacker with low privileges can inject arbitrary JavaScript by manipulating this parameter, which is then rendered back to the user's browser without proper encoding. Successful exploitation allows the execution of malicious scripts in the context of the victim's session, potentially leading to session hijacking or unauthorized data access. A public exploit (Proof of Concept) is available.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-06-13: disclosed: Vulnerability reported on GitHub by zzb1388
- 2026-07-19: advisory: CVE published to NVD