Executive brief
SourceCodester Class and Exam Timetabling System, a web-based application for managing academic schedules, is vulnerable to a security flaw that allows attackers to inject malicious scripts. By tricking a user into clicking a specially crafted link, an attacker could execute code in the user's browser to steal session information or perform unauthorized actions. This could lead to unauthorized access to the scheduling system or the compromise of user accounts.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 within the /BSIS.php file. The vulnerability is caused by insufficient sanitization of the 'day' parameter, which is directly reflected into the web page output. A remote, unauthenticated attacker can exploit this by persuading a user to visit a malicious URL containing a crafted script payload. Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking (cookie theft) or unauthorized actions on behalf of the user. A public proof-of-concept using the payload <script>prompt(/xss/);</script> has been disclosed.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-06-16: disclosed: Vulnerability reported on GitHub repository
- 2026-07-21: advisory: CVE published to NVD dataset